xccdf_org.open-scap_testresult_cis_level2_workstation

Guide to the Secure Configuration of Ubuntu 20.04

with profile CIS Ubuntu 20.04 Level 2 Workstation Benchmark
This baseline aligns to the Center for Internet Security Ubuntu 20.04 LTS Benchmark, v1.0.0, released 07-21-2020.

The SCAP Security Guide Project
https://www.open-scap.org/security-policies/scap-security-guide

This guide presents a catalog of security-relevant configuration settings for Ubuntu 20.04. It is a rendering of content structured in the eXtensible Configuration Checklist Description Format (XCCDF) in order to support security automation. The SCAP content is is available in the scap-security-guide package which is developed at https://www.open-scap.org/security-policies/scap-security-guide.

Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.

Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. The creators of this guidance assume no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Evaluation Characteristics

Evaluation target	ubuntu-pro-1
Benchmark URL	/usr/share/ubuntu-scap-security-guides/current/benchmarks/Canonical_Ubuntu_20.04_Benchmarks-xccdf.xml
Profile ID	cis_level2_workstation
Started at	2023-09-07T09:13:06
Finished at	2023-09-07T09:13:40
Performed by	vavirrus

CPE Platforms

cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~

Addresses

IPv4 127.0.0.1
IPv4 10.128.0.3
IPv6 0:0:0:0:0:0:0:1
IPv6 fe80:0:0:0:4001:aff:fe80:3
MAC 00:00:00:00:00:00
MAC 42:01:0A:80:00:03

Compliance and Scoring

The target system did not satisfy the conditions of 187 rules! Please review rule results and consider applying remediation.

Rule results

159 passed

187 failed

1 other

Severity of failed rules

3 other

17 low

165 medium

2 high

Score

Scoring system	Score	Maximum	Percent
urn:xccdf:scoring:default	62.374767	100.000000	62.37%

Rule Overview

Title	Severity	Result
Guide to the Secure Configuration of Ubuntu 20.04 187x fail 1x notchecked
System Settings 156x fail 1x notchecked
Installing and Maintaining Software 11x fail
System and Software Integrity 3x fail
Software Integrity Checking 3x fail
Verify Integrity with AIDE 3x fail
Install AIDE	medium	fail
Build and Test AIDE Database	medium	fail
Configure Periodic Execution of AIDE	medium	fail
Disable Prelinking via removing prelink package	medium	pass
Disk Partitioning 6x fail
Ensure /home Located On Separate Partition	low	fail
Ensure /tmp Located On Separate Partition	low	fail
Ensure /var Located On Separate Partition	low	fail
Ensure /var/log Located On Separate Partition	medium	fail
Ensure /var/log/audit Located On Separate Partition	low	fail
Ensure /var/tmp Located On Separate Partition	low	fail
GNOME Desktop Environment
Configure GNOME Login Screen
Disable the GNOME3 Login User List	medium	notapplicable
Configure GNOME3 DConf User Profile	high	notapplicable
Sudo 2x fail
Install sudo Package	medium	pass
Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty	medium	fail
Ensure Sudo Logfile Exists - sudo logfile	low	fail
Account and Access Control 26x fail 1x notchecked
Warning Banners for System Accesses 2x fail
Implement a GUI Warning Banner
Enable GNOME3 Login Warning Banner	medium	notapplicable
Set the GNOME3 Login Warning Banner Text	medium	notapplicable
Verify Group Ownership of System Login Banner	medium	pass
Verify Group Ownership of Remote Login Banner	medium	pass
Verify Group Ownership of Message of the Day Banner	medium	pass
Verify ownership of System Login Banner	medium	pass
Verify ownership of Remote Login Banner	medium	pass
Verify ownership of Message of the Day Banner	medium	pass
Verify permissions on System Login Banner	medium	pass
Verify permissions on Remote Login Banner	medium	pass
Verify permissions on Message of the Day Banner	medium	pass
Ensure local login warning banner is configured properly	medium	fail
Ensure remote login warning banner is configured properly	medium	fail
Ensure message of the day is configured properly	medium	pass
Protect Accounts by Configuring PAM 10x fail
Set Lockouts for Failed Password Attempts 2x fail
Limit Password Reuse	medium	fail
Set Deny For Failed Password Attempts	medium	fail
Set Password Quality Requirements 7x fail
Set Password Quality Requirements with pam_pwquality 7x fail
Ensure PAM Enforces Password Requirements - Minimum Digit Characters	medium	fail
Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters	medium	fail
Ensure PAM Enforces Password Requirements - Minimum Different Categories	medium	fail
Ensure PAM Enforces Password Requirements - Minimum Length	medium	fail
Ensure PAM Enforces Password Requirements - Minimum Special Characters	medium	fail
Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session	medium	fail
Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters	medium	fail
Install pam_pwquality Package	medium	fail
Protect Physical Console Access 1x fail
Ensure authentication required for single user mode	medium	fail
Protect Accounts by Restricting Password-Based Login 5x fail
Set Account Expiration Parameters 1x fail
Set Account Expiration Following Inactivity	medium	fail
Set Password Expiration Parameters 2x fail
Set Password Maximum Age	medium	fail
Set Password Minimum Age	medium	fail
Set Existing Passwords Maximum Age	medium	pass
Set Existing Passwords Minimum Age	medium	pass
Set Password Warning Age	medium	pass
Ensure all users last password change date is in the past	medium	pass
Verify Proper Storage and Existence of Password Hashes
Verify All Account Password Hashes are Shadowed with SHA512	medium	pass
Ensure all groups in /etc/passwd exist in /etc/group	medium	pass
Ensure shadow group is empty	medium	pass
Ensure no duplicate GIDs exist	medium	pass
Ensure no duplicate group names exist	medium	pass
Ensure no duplicate UIDs exist	medium	pass
Ensure no duplicate user names exist	medium	pass
Lock Accounts With Empty Password Field	high	pass
Ensure users' .netrc Files are not group or world accessible	medium	pass
Verify No netrc Files Exist	medium	pass
Restrict Root Logins 2x fail
Ensure default group for the root account is GID 0	medium	pass
Verify Only Root Has UID 0	high	pass
Ensure the group used by pam_wheel module exists on system and is empty	medium	fail
Ensure that System Accounts Do Not Run a Shell Upon Login	medium	pass
Enforce usage of pam_wheel with group parameter for su authentication	medium	fail
Secure Session Configuration Files for Login Accounts 8x fail 1x notchecked
Ensure that No Dangerous Directories Exist in Root's Path
Ensure that Root's Path Does Not Include World or Group-Writable Directories	medium	pass
Ensure that Users Have Sensible Umask Values 4x fail 1x notchecked
Ensure the Default Bash Umask is Set Correctly	medium	fail
Ensure the Default C Shell Umask is Set Correctly	unknown	fail
Ensure the Default Umask is Set Correctly in login.defs	medium	fail
Ensure the Default Umask is Set Correctly in /etc/profile	unknown	fail
Ensure the Default Umask is Set Correctly For Interactive Users	medium	notchecked
Set Interactive Session Timeout	medium	fail
User Initialization Files Must Be Owned By the Primary User	medium	pass
All Interactive Users Home Directories Must Exist	medium	pass
Ensure users own their home directories	medium	pass
Ensure appropriate umask set for adduser	medium	fail
All Interactive User Home Directories Must Have mode 0750 Or Less Permissive	medium	fail
Ensure no users have .forward files	medium	pass
Ensure users' dot files are not group or world writable	medium	pass
Ensure appropriate homedir mode set for useradd	medium	fail
System Accounting with auditd 75x fail
Configure auditd Rules for Comprehensive Auditing 66x fail
Record Events that Modify the System's Discretionary Access Controls 13x fail
Record Events that Modify the System's Discretionary Access Controls - chmod	medium	fail
Record Events that Modify the System's Discretionary Access Controls - chown	medium	fail
Record Events that Modify the System's Discretionary Access Controls - fchmod	medium	fail
Record Events that Modify the System's Discretionary Access Controls - fchmodat	medium	fail
Record Events that Modify the System's Discretionary Access Controls - fchown	medium	fail
Record Events that Modify the System's Discretionary Access Controls - fchownat	medium	fail
Record Events that Modify the System's Discretionary Access Controls - fremovexattr	medium	fail
Record Events that Modify the System's Discretionary Access Controls - fsetxattr	medium	fail
Record Events that Modify the System's Discretionary Access Controls - lchown	medium	fail
Record Events that Modify the System's Discretionary Access Controls - lremovexattr	medium	fail
Record Events that Modify the System's Discretionary Access Controls - lsetxattr	medium	fail
Record Events that Modify the System's Discretionary Access Controls - removexattr	medium	fail
Record Events that Modify the System's Discretionary Access Controls - setxattr	medium	fail
Record File Deletion Events by User 4x fail
Ensure auditd Collects File Deletion Events by User - rename	medium	fail
Ensure auditd Collects File Deletion Events by User - renameat	medium	fail
Ensure auditd Collects File Deletion Events by User - unlink	medium	fail
Ensure auditd Collects File Deletion Events by User - unlinkat	medium	fail
Record Unauthorized Access Attempts Events to Files (unsuccessful) 5x fail
Record Unsuccessful Access Attempts to Files - creat	medium	fail
Record Unsuccessful Access Attempts to Files - ftruncate	medium	fail
Record Unsuccessful Access Attempts to Files - open	medium	fail
Record Unsuccessful Access Attempts to Files - openat	medium	fail
Record Unsuccessful Access Attempts to Files - truncate	medium	fail
Record Information on Kernel Modules Loading and Unloading 2x fail
Ensure auditd Collects Information on Kernel Module Unloading - delete_module	medium	fail
Ensure auditd Collects Information on Kernel Module Loading - init_module	medium	fail
Record Attempts to Alter Logon and Logout Events 3x fail
Record Attempts to Alter Logon and Logout Events - faillog	medium	fail
Record Attempts to Alter Logon and Logout Events - lastlog	medium	fail
Record Attempts to Alter Logon and Logout Events - tallylog	medium	fail
Record Information on the Use of Privileged Commands 22x fail
Ensure auditd Collects Information on the Use of Privileged Commands - at	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - chage	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - chfn	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - chsh	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - crontab	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - insmod	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - modprobe	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - mount	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - newgrp	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - postdrop	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - postqueue	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - rmmod	medium	fail
Record Any Attempts to Run ssh-agent	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - su	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - sudo	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - umount	medium	fail
Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd	medium	fail
Records Events that Modify Date and Time Information 5x fail
Record attempts to alter time through adjtimex	medium	fail
Record Attempts to Alter Time Through clock_settime	medium	fail
Record attempts to alter time through settimeofday	medium	fail
Record Attempts to Alter Time Through stime	medium	fail
Record Attempts to Alter the localtime File	medium	fail
Make the auditd Configuration Immutable	medium	fail
Record Events that Modify the System's Mandatory Access Controls	medium	fail
Ensure auditd Collects Information on Exporting to Media (successful)	medium	fail
Record Events that Modify the System's Network Environment	medium	fail
Record Attempts to Alter Process and Session Initiation Information	medium	fail
Record Events When Privileged Executables Are Run	medium	fail
Ensure auditd Collects System Administrator Actions	medium	fail
Record Events that Modify User/Group Information - /etc/group	medium	fail
Record Events that Modify User/Group Information - /etc/gshadow	medium	fail
Record Events that Modify User/Group Information - /etc/security/opasswd	medium	fail
Record Events that Modify User/Group Information - /etc/passwd	medium	fail
Record Events that Modify User/Group Information - /etc/shadow	medium	fail
Configure auditd Data Retention 5x fail
Configure auditd mail_acct Action on Low Disk Space	medium	fail
Configure auditd admin_space_left Action on Low Disk Space	medium	fail
Configure auditd Max Log File Size	medium	fail
Configure auditd max_log_file_action Upon Reaching Maximum Log Size	medium	fail
Configure auditd space_left Action on Low Disk Space	medium	fail
Ensure the audit Subsystem is Installed	medium	fail
Enable auditd Service	medium	fail
Enable Auditing for Processes Which Start Prior to the Audit Daemon	medium	fail
Extend Audit Backlog Limit for the Audit Daemon	medium	fail
AppArmor 2x fail
Ensure AppArmor is installed	medium	pass
Ensure all AppArmor Profiles are in enforce mode	medium	fail
Ensure all AppArmor Profiles are in enforce or complain mode	medium	pass
Ensure AppArmor is enabled in the bootloader configuration	medium	fail
GRUB2 bootloader configuration 1x fail
Non-UEFI GRUB2 bootloader configuration
Verify /boot/grub/grub.cfg User Ownership	medium	notapplicable
Verify /boot/grub/grub.cfg Permissions	medium	notapplicable
Set Boot Loader Password in grub2	high	notapplicable
UEFI GRUB2 bootloader configuration 1x fail
Set the UEFI Boot Loader Password	high	fail
Configure Syslog 6x fail
Configure journald 3x fail
Ensure journald is configured to compress large log files	medium	fail
Ensure journald is configured to send logs to rsyslog	medium	fail
Ensure journald is configured to write logfiles to persistent disk	medium	fail
Ensure All Logs are Rotated by logrotate 1x fail
Ensure logrotate assigns appropriate permissions	medium	fail
Rsyslog Logs Sent To Remote Host 1x fail
Ensure Logs Sent To Remote Host	medium	fail
Ensure rsyslog is Installed	medium	pass
Enable rsyslog Service	medium	pass
Ensure permissions on all logfiles are configured	medium	fail
Ensure rsyslog default file permissions configured	medium	pass
Network Configuration and Firewalls 25x fail
iptables and ip6tables 9x fail
Ensure loopback traffic is configured 6x fail
Trafic in on lo is allowed	medium	fail
Traffic out on lo is allowed	medium	fail
Inbound traffic for ::1/128 on any other interface is denied.	medium	fail
Trafic in on lo is allowed	medium	fail
Traffic out on lo is allowed	medium	fail
Inbound traffic for 127.0.0.0/8 on any other interface is denied.	medium	fail
Strengthen the Default Ruleset 2x fail
Ensure default deny firewall policy - iptables6	medium	fail
Ensure default deny firewall policy	medium	fail
Install iptables-persistent Package	medium	fail
Install iptables Package	medium	pass
Remove iptables-persistent Package	medium	pass
IPv6 7x fail
Configure IPv6 Settings if Necessary 7x fail
Configure Accepting Router Advertisements on All IPv6 Interfaces	medium	fail
Disable Accepting ICMP Redirects for All IPv6 Interfaces	medium	fail
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces	medium	fail
Disable Kernel Parameter for IPv6 Forwarding	medium	fail
Disable Accepting Router Advertisements on all IPv6 Interfaces by Default	medium	fail
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces	medium	fail
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default	medium	fail
Kernel Parameters Which Affect Networking 4x fail
Network Related Kernel Runtime Parameters for Hosts and Routers 4x fail
Disable Accepting ICMP Redirects for All IPv4 Interfaces	medium	pass
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces	medium	pass
Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces	unknown	pass
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces	medium	fail
Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces	medium	fail
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces	medium	pass
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default	medium	pass
Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default	unknown	pass
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default	medium	fail
Configure Kernel Parameter for Accepting Secure Redirects By Default	medium	fail
Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces	medium	pass
Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces	unknown	pass
Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces	medium	pass
Network Parameters for Hosts Only
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces	medium	pass
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default	medium	pass
Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces	medium	pass
nftables
Ensure loopback traffic is configured
Trafic in on lo is allowed	medium	notapplicable
Inbound traffic for 127.0.0.0/8 on any other interface is denied.	medium	notapplicable
Inbound traffic for ::1/128 on any other interface is denied.	medium	notapplicable
Install nftables Package	medium	pass
Remove nftables Package	medium	pass
Verify nftables Enabled	medium	pass
Ensure default deny firewall policy	medium	notapplicable
Ensure base chains exist	medium	notapplicable
Ensure a table exists	medium	notapplicable
Ensure nftables rules are permanent	medium	notapplicable
Uncomplicated Firewall (ufw) 1x fail
Ensure loopback traffic is configured
Trafic in on lo is allowed	medium	notapplicable
Traffic out on lo is allowed	medium	notapplicable
Inbound traffic for 127.0.0.0/8 on any other interface is denied.	medium	notapplicable
Inbound traffic for ::1/128 on any other interface is denied.	medium	notapplicable
Install ufw Package	medium	pass
Remove ufw Package	medium	fail
Verify ufw Enabled	medium	pass
Ensure default deny firewall policy	medium	notapplicable
Uncommon Network Protocols 4x fail
Disable DCCP Support	medium	fail
Disable RDS Support	low	fail
Disable SCTP Support	medium	fail
Disable TIPC Support	medium	fail
Wireless Networking
Disable Wireless Through Software Configuration
Deactivate Wireless Network Interfaces	medium	pass
File Permissions and Masks 10x fail
Verify Permissions on Important Files and Directories
Verify Permissions on Files with Local Account Information and Credentials
Verify Group Who Owns Backup group File	medium	pass
Verify Group Who Owns Backup gshadow File	medium	pass
Verify Group Who Owns Backup passwd File	medium	pass
Verify User Who Owns Backup shadow File	medium	pass
Verify Group Who Owns group File	medium	pass
Verify Group Who Owns gshadow File	medium	pass
Verify Group Who Owns passwd File	medium	pass
Verify Group Who Owns shadow File	medium	pass
Verify User Who Owns Backup group File	medium	pass
Verify User Who Owns Backup gshadow File	medium	pass
Verify User Who Owns Backup passwd File	medium	pass
Verify Group Who Owns Backup shadow File	medium	pass
Verify User Who Owns group File	medium	pass
Verify User Who Owns gshadow File	medium	pass
Verify User Who Owns passwd File	medium	pass
Verify User Who Owns shadow File	medium	pass
Verify Permissions on Backup group File	medium	pass
Verify Permissions on Backup gshadow File	medium	pass
Verify Permissions on Backup passwd File	medium	pass
Verify Permissions on Backup shadow File	medium	pass
Verify Permissions on group File	medium	pass
Verify Permissions on gshadow File	medium	pass
Verify Permissions on passwd File	medium	pass
Verify Permissions on shadow File	medium	pass
Verify that All World-Writable Directories Have Sticky Bits Set	medium	pass
Ensure No World-Writable Files Exist	medium	pass
Ensure All Files Are Owned by a User	medium	pass
Ensure no ungrouped files or directories exist	medium	pass
Restrict Dynamic Mounting and Unmounting of Filesystems 7x fail
Disable the Automounter	medium	pass
Disable Mounting of cramfs	low	fail
Disable Mounting of freevxfs	low	fail
Disable Mounting of hfs	low	fail
Disable Mounting of hfsplus	low	fail
Disable Mounting of jffs2	low	fail
Disable Mounting of udf	low	fail
Disable Modprobe Loading of USB Storage Driver	medium	fail
Restrict Partition Mount Options 1x fail
Add nodev Option to /dev/shm	low	pass
Add noexec Option to /dev/shm	low	fail
Add nosuid Option to /dev/shm	low	pass
Add nodev Option to /home if it exists	unknown	pass
Add nodev Option to /tmp if it exists	medium	pass
Add noexec Option to /tmp if it exists	medium	pass
Add nosuid Option to /tmp if it exists	medium	pass
Add nodev Option to /var/tmp if it exists	medium	pass
Add noexec Option to /var/tmp if it exists	medium	pass
Add nosuid Option to /var/tmp if it exists	medium	pass
Restrict Programs from Dangerous Execution Patterns 2x fail
Disable Core Dumps 2x fail
Disable Core Dumps for All Users	medium	fail
Disable Core Dumps for SUID programs	medium	fail
Enable ExecShield
Enable Randomized Layout of Virtual Address Space	medium	pass
Enable Execute Disable (XD) or No Execute (NX) Support on x86 Systems
Ensure XD/NX support is enabled	medium	pass
Services 31x fail
Apport Service 1x fail
Disable Apport Service	unknown	fail
Avahi Server
Disable Avahi Server if Possible
Uninstall avahi-daemon Package	low	pass
Disable Avahi Server Software	medium	pass
Cron and At Daemons 8x fail
Restrict at and cron to Authorized Users if Necessary 2x fail
Verify Group Who Owns /etc/at.allow file	medium	pass
Verify Group Who Owns /etc/cron.allow file	medium	pass
Verify User Who Owns /etc/at.allow file	medium	pass
Verify User Who Owns /etc/cron.allow file	medium	pass
Verify Permissions on /etc/at.allow file	medium	pass
Verify Permissions on /etc/cron.allow file	medium	pass
Ensure at is restricted to authorized users	medium	fail
Ensure cron is restricted to authorized users	medium	fail
Enable cron Service	medium	pass
Verify Group Who Owns cron.d	medium	pass
Verify Group Who Owns cron.daily	medium	pass
Verify Group Who Owns cron.hourly	medium	pass
Verify Group Who Owns cron.monthly	medium	pass
Verify Group Who Owns cron.weekly	medium	pass
Verify Group Who Owns Crontab	medium	pass
Verify Owner on cron.d	medium	pass
Verify Owner on cron.daily	medium	pass
Verify Owner on cron.hourly	medium	pass
Verify Owner on cron.monthly	medium	pass
Verify Owner on cron.weekly	medium	pass
Verify Owner on crontab	medium	pass
Verify Permissions on cron.d	medium	fail
Verify Permissions on cron.daily	medium	fail
Verify Permissions on cron.hourly	medium	fail
Verify Permissions on cron.monthly	medium	fail
Verify Permissions on cron.weekly	medium	fail
Verify Permissions on crontab	medium	fail
Deprecated services
Uninstall the nis package	low	pass
DHCP
Disable DHCP Server
Uninstall DHCP Server Package	medium	pass
DNS Server
Disable DNS Server
Uninstall bind Package	low	pass
FTP Server
Disable vsftpd if Possible
Uninstall vsftpd Package	high	pass
Web Server
Disable Apache if Possible
Uninstall httpd Package	unknown	pass
IMAP and POP3 Server
Disable Dovecot
Uninstall dovecot Package	unknown	pass
LDAP
Configure OpenLDAP Clients
Ensure LDAP client is not installed	low	pass
Configure OpenLDAP Server
Uninstall openldap-servers Package	low	pass
Mail Server Software
Configure SMTP For Mail Clients
Disable Postfix Network Listening	medium	pass
Ensure mail transfer agent is configured for local-only mode	medium	pass
NFS and RPC
Disable All NFS Services if Possible
Disable Services Used Only by NFS
Uninstall nfs-kernel-server Package	low	pass
Uninstall rpcbind Package	low	pass
Network Time Protocol
The Chrony package is installed	medium	pass
Install the ntp service	high	pass
The Chrony package is removed	medium	pass
Remove the ntp package	high	pass
Enable the Chrony Daemon	medium	pass
Enable the NTP Daemon	high	pass
Ensure that chronyd is running under chrony user account	medium	pass
A remote time server for Chrony is configured	medium	pass
Obsolete Services 2x fail
Xinetd
Uninstall openbsd-inetd Package	low	pass
Uninstall xinetd Package	low	pass
Rlogin, Rsh, and Rexec
Uninstall rsh Package	unknown	pass
Remove Rsh Trust Files	high	pass
Chat/Messaging Services
Uninstall talk Package	medium	pass
Telnet 1x fail
Remove telnet Clients	low	fail
Uninstall rsync Package	low	fail
Print Support
Uninstall cups Package	low	pass
Disable the CUPS Service	unknown	pass
Proxy Server
Disable Squid if Possible
Uninstall squid Package	unknown	pass
Samba(SMB) Microsoft Windows File Sharing Server
Disable Samba if Possible
Uninstall Samba Package	unknown	pass
SNMP Server
Disable SNMP Server if Possible
Uninstall net-snmp Package	unknown	pass
SSH Server 20x fail
Configure OpenSSH Server if Necessary 19x fail
Ensure SSH Access is Limited 4x fail
Restrict sshd user access via AllowGroups	medium	fail
Restrict sshd user access via AllowUsers	medium	fail
Restrict sshd user access via DenyGroups	medium	fail
Restrict sshd user access via DenyUsers	medium	fail
Disable Host-Based Authentication	medium	pass
Disable SSH Access via Empty Passwords	high	fail
Disable SSH Support for .rhosts Files	medium	fail
Disable SSH Root Login	medium	fail
Disable SSH TCP Forwarding	medium	fail
Disable X11 Forwarding	medium	fail
Do Not Allow SSH Environment Options	medium	fail
Enable PAM	medium	pass
Enable SSH Warning Banner	medium	fail
Set SSH Idle Timeout Interval	medium	fail
Set SSH Client Alive Count Max	medium	fail
Set SSH LoginGraceTime limit	medium	fail
Set LogLevel to INFO or VERBOSE	low	fail
Set SSH authentication attempt limit	medium	pass
Set SSH MaxSessions limit	medium	fail
Ensure SSH MaxStartups is configured	medium	fail
Use Only Approved Ciphers	medium	fail
Use Only Approved KEXs	medium	pass
Use Only Approved MACs	medium	fail
Verify Group Who Owns SSH Server config file	medium	pass
Verify Owner on SSH Server config file	medium	pass
Verify Permissions on SSH Server config file	medium	fail
Verify Permissions on SSH Server Private *_key Key Files	medium	pass
Verify Permissions on SSH Server Public *.pub Key Files	medium	pass

Result Details

Install AIDE

Rule ID package_aide_installed

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

References: ANSSI§BP28(R51), CIS§1.4.1, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§5, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.10.1.3, COBIT5§APO01.06, COBIT5§BAI01.06, COBIT5§BAI02.01, COBIT5§BAI03.05, COBIT5§BAI06.01, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS04.07, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.02, COBIT5§DSS06.06, DISA§CCI-002696, DISA§CCI-002699, DISA§CCI-001744, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2009§4.3.4.4.4, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.3, ISA-62443-2013§SR 3.4, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.6, ISM§1034, ISM§1288, ISM§1341, ISM§1417, ISO27001-2013§A.11.2.4, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.2.1, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.8.2.3, NIST§CM-6(a), NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-7, NIST-CSF§PR.DS-1, NIST-CSF§PR.DS-6, NIST-CSF§PR.DS-8, NIST-CSF§PR.IP-1, NIST-CSF§PR.IP-3, PCIDSS§Req-11.5, SRG§SRG-OS-000363-GPOS-00150, SRG§SRG-OS-000445-GPOS-00199, STIGID§UBTU-20-010450

Description

The aide package can be installed with the following command:

$ apt-get install aide

Rationale

The AIDE package must be installed if it is to be available for integrity checking.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

DEBIAN_FRONTEND=noninteractive apt-get install -y "aide"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Ensure aide is installed
  package:
    name: aide
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - DISA-STIG-UBTU-20-010450
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_aide_installed

Remediation Puppet snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

include install_aide

class install_aide {
  package { 'aide':
    ensure => 'installed',
  }
}

Remediation script: (show)


[[packages]]
name = "aide"
version = "*"

Build and Test AIDE Database

Rule ID aide_build_database

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

References: ANSSI§BP28(R51), CIS§1.4.1, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§5, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.10.1.3, COBIT5§APO01.06, COBIT5§BAI01.06, COBIT5§BAI02.01, COBIT5§BAI03.05, COBIT5§BAI06.01, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS04.07, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.02, COBIT5§DSS06.06, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2009§4.3.4.4.4, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.3, ISA-62443-2013§SR 3.4, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.4, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.2.1, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.8.2.3, NIST§CM-6(a), NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-7, NIST-CSF§PR.DS-1, NIST-CSF§PR.DS-6, NIST-CSF§PR.DS-8, NIST-CSF§PR.IP-1, NIST-CSF§PR.IP-3, PCIDSS§Req-11.5

Description

Run the following command to generate a new database:

$ sudo /usr/sbin/aide --init

By default, the database will be written to the file /var/lib/aide/aide.db.new.gz. Storing the database, the configuration file /etc/aide.conf, and the binary /usr/sbin/aide (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity. The newly-generated database can be installed as follows:

$ sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

To initiate a manual check, run the following command:

$ sudo /usr/sbin/aide --check

If this check produces any unexpected output, investigate.

Rationale

For AIDE to be effective, an initial database of "known-good" information about files must be captured and it should be able to be verified against the installed files.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

DEBIAN_FRONTEND=noninteractive apt-get install -y "aide"



AIDE_CONFIG=/etc/aide/aide.conf
DEFAULT_DB_PATH=/var/lib/aide/aide.db

# Fix db path in the config file, if necessary
if ! grep -q '^database=file:' ${AIDE_CONFIG}; then
    # replace_or_append gets confused by 'database=file' as a key, so should not be used.
    #replace_or_append "${AIDE_CONFIG}" '^database=file' "${DEFAULT_DB_PATH}" '' '%s:%s'
    echo "database=file:${DEFAULT_DB_PATH}" >> ${AIDE_CONFIG}
fi

# Fix db out path in the config file, if necessary
if ! grep -q '^database_out=file:' ${AIDE_CONFIG}; then
    echo "database_out=file:${DEFAULT_DB_PATH}.new" >> ${AIDE_CONFIG}
fi

/usr/sbin/aideinit -y -f

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Ensure AIDE is installed
  package:
    name: '{{ item }}'
    state: present
  with_items:
    - aide
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Build and Test AIDE Database
  command: /usr/sbin/aide --init
  changed_when: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check whether the stock AIDE Database exists
  stat:
    path: /var/lib/aide/aide.db.new.gz
  register: aide_database_stat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Stage AIDE Database
  copy:
    src: /var/lib/aide/aide.db.new.gz
    dest: /var/lib/aide/aide.db.gz
    backup: true
    remote_src: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (aide_database_stat.stat.exists is defined and aide_database_stat.stat.exists)
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Configure Periodic Execution of AIDE

Rule ID aide_periodic_cron_checking

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

Description

At a minimum, AIDE should be configured to run a weekly scan. To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:

05 4 * * * root /usr/sbin/aide --check

To implement a weekly execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:

05 4 * * 0 root /usr/sbin/aide --check

AIDE can be executed periodically through other means; this is merely one example. The usage of cron's special time codes, such as @daily and @weekly is acceptable.

Rationale

By default, AIDE does not install itself for periodic execution. Periodically running AIDE is necessary to reveal unexpected changes in installed files.

Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.

Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

DEBIAN_FRONTEND=noninteractive apt-get install -y "aide"

# AiDE usually adds its own cron jobs to /etc/cron.daily. If script is there, this rule is
# compliant. Otherwise, we copy the script to the /etc/cron.weekly
if ! egrep -q '^(/usr/bin/)?aide\.wrapper\s+' /etc/cron.*/*; then
    cp -f /usr/share/aide/config/cron.daily/aide /etc/cron.weekly/
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Ensure AIDE is installed
  package:
    name: '{{ item }}'
    state: present
  with_items:
    - aide
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - DISA-STIG-UBTU-20-010074
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Configure Periodic Execution of AIDE
  cron:
    name: run AIDE check
    minute: 5
    hour: 4
    weekday: 0
    user: root
    job: /usr/sbin/aide --check
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - DISA-STIG-UBTU-20-010074
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Disable Prelinking via removing prelink package

Rule ID	package_prelink_removed
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.6.3, CIS-CSC§11, CIS-CSC§13, CIS-CSC§14, CIS-CSC§2, CIS-CSC§3, CIS-CSC§9, CJIS§5.10.1.3, COBIT5§APO01.06, COBIT5§BAI02.01, COBIT5§BAI03.05, COBIT5§BAI06.01, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS04.07, COBIT5§DSS05.03, COBIT5§DSS06.02, COBIT5§DSS06.06, CUI§3.13.11, DISA§CCI-000803, DISA§CCI-002450, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2009§4.3.4.4.4, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.3, ISA-62443-2013§SR 3.4, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.4, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.2.1, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.8.2.3, NERC-CIP§CIP-003-3 R4.2, NERC-CIP§CIP-007-3 R5.1, NIST§SC-13, NIST§CM-6(a), NIST-CSF§PR.DS-1, NIST-CSF§PR.DS-6, NIST-CSF§PR.DS-8, NIST-CSF§PR.IP-1, PCIDSS§Req-11.5, VMMSRG§SRG-OS-000120-VMM-000600, VMMSRG§SRG-OS-000478-VMM-001980, VMMSRG§SRG-OS-000396-VMM-001590
Description	The prelinking feature changes binaries in an attempt to decrease their startup time. In order to disable it, run the following command to return binaries to a normal, non-prelinked state: $ sudo /usr/sbin/prelink -ua Then remove the `prelink` package.
Rationale	Because the prelinking feature changes binaries, it can interfere with the operation of certain software and/or modes such as AIDE, FIPS, etc.

Ensure /home Located On Separate Partition

Rule ID	partition_for_home
Result	fail
Time	2023-09-07T09:13:06
Severity	low
Identifiers and References	References: ANSSI§BP28(R12), CIS§1.1.17, CIS-CSC§12, CIS-CSC§15, CIS-CSC§8, COBIT5§APO13.01, COBIT5§DSS05.02, DISA§CCI-000366, DISA§CCI-001208, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, NIST§CM-6(a), NIST§SC-5(2), NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227
Description	If user home directories will be stored locally, create a separate partition for `/home` at installation time (or migrate it later using LVM). If `/home` will be mounted from another system such as an NFS server, then creating a separate partition is not necessary at installation time, and the mountpoint can instead be configured later.
Rationale	Ensuring that `/home` is mounted on its own partition enables the setting of more restrictive mount options, and also helps ensure that users cannot trivially fill partitions used for log or audit data storage.

Ensure /tmp Located On Separate Partition

Rule ID	partition_for_tmp
Result	fail
Time	2023-09-07T09:13:06
Severity	low
Identifiers and References	References: ANSSI§BP28(R12), CIS§1.1.2, CIS-CSC§12, CIS-CSC§15, CIS-CSC§8, COBIT5§APO13.01, COBIT5§DSS05.02, DISA§CCI-000366, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, NIST§CM-6(a), NIST§SC-5(2), NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227
Description	The `/tmp` directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.
Rationale	The `/tmp` partition is used as temporary storage by many programs. Placing `/tmp` in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.

Ensure /var Located On Separate Partition

Rule ID	partition_for_var
Result	fail
Time	2023-09-07T09:13:06
Severity	low
Identifiers and References	References: ANSSI§BP28(R12), CIS§1.1.10, CIS-CSC§12, CIS-CSC§15, CIS-CSC§8, COBIT5§APO13.01, COBIT5§DSS05.02, DISA§CCI-000366, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, NIST§CM-6(a), NIST§SC-5(2), NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227, VMMSRG§SRG-OS-000341-VMM-001220
Description	The `/var` directory is used by daemons and other system services to store frequently-changing data. Ensure that `/var` has its own partition or logical volume at installation time, or migrate it using LVM.
Rationale	Ensuring that `/var` is mounted on its own partition enables the setting of more restrictive mount options. This helps protect system services such as daemons or other programs which use it. It is not uncommon for the `/var` directory to contain world-writable directories installed by other software packages.

Ensure /var/log Located On Separate Partition

Rule ID	partition_for_var_log
Result	fail
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: ANSSI§BP28(R12), ANSSI§BP28(R47), CIS§1.1.15, CIS-CSC§1, CIS-CSC§12, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, CIS-CSC§8, COBIT5§APO11.04, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§MEA02.01, DISA§CCI-000366, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, NERC-CIP§CIP-007-3 R6.5, NIST§CM-6(a), NIST§AU-4, NIST§SC-5(2), NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227
Description	System logs are stored in the `/var/log` directory. Ensure that `/var/log` has its own partition or logical volume at installation time, or migrate it using LVM.
Rationale	Placing `/var/log` in its own partition enables better separation between log files and other files in `/var/`.

Ensure /var/log/audit Located On Separate Partition

Rule ID	partition_for_var_log_audit
Result	fail
Time	2023-09-07T09:13:06
Severity	low
Identifiers and References	References: ANSSI§BP28(R43), CIS§1.1.16, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, CIS-CSC§8, COBIT5§APO11.04, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI04.04, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§MEA02.01, DISA§CCI-000366, DISA§CCI-001849, HIPAA§164.312(a)(2)(ii), ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.17.2.1, NERC-CIP§CIP-007-3 R6.5, NIST§CM-6(a), NIST§AU-4, NIST§SC-5(2), NIST-CSF§PR.DS-4, NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, SRG§SRG-OS-000341-GPOS-00132, SRG§SRG-OS-000480-GPOS-00227, VMMSRG§SRG-OS-000341-VMM-001220
Description	Audit logs are stored in the `/var/log/audit` directory. Ensure that `/var/log/audit` has its own partition or logical volume at installation time, or migrate it using LVM. Make absolutely certain that it is large enough to store all audit logs that will be created by the auditing daemon.
Rationale	Placing `/var/log/audit` in its own partition enables better separation between audit files and other files, and helps ensure that auditing cannot be halted due to the partition running out of space.

Ensure /var/tmp Located On Separate Partition

Rule ID	partition_for_var_tmp
Result	fail
Time	2023-09-07T09:13:06
Severity	low
Identifiers and References	References: ANSSI§BP28(R12), CIS§1.1.11, SRG§SRG-OS-000480-GPOS-00227
Description	The `/var/tmp` directory is a world-writable directory used for temporary file storage. Ensure it has its own partition or logical volume at installation time, or migrate it using LVM.
Rationale	The `/var/tmp` partition is used as temporary storage by many programs. Placing `/var/tmp` in its own partition enables the setting of more restrictive mount options, which can help protect programs which use it.

Disable the GNOME3 Login User List

Rule ID	dconf_gnome_disable_user_list
Result	notapplicable
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.10, NIST§CM-6(a), NIST§AC-23
Description	In the default graphical environment, users logging directly into the system are greeted with a login screen that displays all known users. This functionality should be disabled by setting `disable-user-list` to `true`. To disable, add or edit `disable-user-list` to `/etc/gdm3/greeter.dconf-defaults`. For example: [org/gnome/login-screen] disable-user-list=true After the settings have been set, run `dconf update`.
Rationale	Leaving the user list enabled is a security risk since it allows anyone with physical access to the system to quickly enumerate known user accounts without logging in.

Configure GNOME3 DConf User Profile

Rule ID	enable_dconf_user_profile
Result	notapplicable
Time	2023-09-07T09:13:06
Severity	high
Identifiers and References	References: CIS§1.10
Description	By default, DConf provides a standard user profile. This profile contains a list of DConf configuration databases. The user profile and database always take the highest priority. As such the DConf User profile should always exist and be configured correctly. To make sure that the user profile is configured correctly, the `/etc/dconf/profile/gdm` should be set as follows: user-db:user system-db:gdm
Rationale	Failure to have a functional DConf profile prevents GNOME3 configuration settings from being enforced for all users and allows various security risks.

Install sudo Package

Rule ID	package_sudo_installed
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: ANSSI§BP28(R19), CIS§1.3.1, ISM§1382, ISM§1384, ISM§1386, NIST§CM-6(a), SRG§SRG-OS-000324-GPOS-00125
Description	The `sudo` package can be installed with the following command: $ apt-get install sudo
Rationale	`sudo` is a program designed to allow a system administrator to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.

Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty

Rule ID sudo_add_use_pty

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

References: ANSSI§BP28(R58), CIS§1.3.2

Description

The sudo use_pty tag, when specified, will only execute sudo commands from users logged in to a real tty. This should be enabled by making sure that the use_pty tag exists in /etc/sudoers configuration file or any sudo configuration snippets in /etc/sudoers.d/.

Rationale

Requiring that sudo commands be run in a pseudo-terminal can prevent an attacker from retaining access to the user's terminal after the main program has finished executing.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict


if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults.*\buse_pty\b.*$' /etc/sudoers; then
        # sudoers file doesn't define Option use_pty
        echo "Defaults use_pty" >> /etc/sudoers
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Ensure use_pty is enabled in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults.*\buse_pty\b.*$
    line: Defaults use_pty
    validate: /usr/sbin/visudo -cf %s
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_add_use_pty

Ensure Sudo Logfile Exists - sudo logfile

Rule ID sudo_custom_logfile

Result

fail

Time 2023-09-07T09:13:06

Severity low

Identifiers and References

References: CIS§1.3.3

Description

A custom log sudo file can be configured with the 'logfile' tag. This rule configures a sudo custom logfile at the default location suggested by CIS, which uses /var/log/sudo.log.

Rationale

A sudo log file simplifies auditing of sudo commands.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict



var_sudo_logfile='/var/log/sudo.log'



if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults.*\blogfile=("(?:\\"|\\\\|[^"\\\n])*"\B|[^"](?:(?:\\,|\\"|\\ |\\\\|[^", \\\n])*)\b)\b.*$' /etc/sudoers; then
        # sudoers file doesn't define Option logfile
        echo "Defaults logfile=${var_sudo_logfile}" >> /etc/sudoers
    else
        # sudoers file defines Option logfile, remediate if appropriate value is not set
        if ! grep -P "^[\s]*Defaults.*\blogfile=${var_sudo_logfile}\b.*$" /etc/sudoers; then
            
            sed -Ei "s/(^[\s]*Defaults.*\blogfile=)[-]?\w+(\b.*$)/\1${var_sudo_logfile}\2/" /etc/sudoers
        fi
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_sudo_logfile # promote to variable
  set_fact:
    var_sudo_logfile: !!str /var/log/sudo.log
  tags:
    - always

- name: Ensure logfile is enabled with the appropriate value in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults\s(.*)\blogfile=[-]?\w+\b(.*)$
    line: Defaults \1logfile={{ var_sudo_logfile }}\2
    validate: /usr/sbin/visudo -cf %s
    backrefs: true
  register: edit_sudoers_logfile_option
  tags:
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_custom_logfile

- name: Enable logfile option with appropriate value in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    line: Defaults logfile={{ var_sudo_logfile }}
    validate: /usr/sbin/visudo -cf %s
  when: edit_sudoers_logfile_option is defined and not edit_sudoers_logfile_option.changed
  tags:
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_custom_logfile

Enable GNOME3 Login Warning Banner

Rule ID	dconf_gnome_banner_enabled
Result	notapplicable
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.10, CIS-CSC§1, CIS-CSC§12, CIS-CSC§15, CIS-CSC§16, COBIT5§DSS05.04, COBIT5§DSS05.10, COBIT5§DSS06.10, CUI§3.1.9, DISA§CCI-000048, DISA§CCI-000050, DISA§CCI-001384, DISA§CCI-001385, DISA§CCI-001386, DISA§CCI-001387, DISA§CCI-001388, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISO27001-2013§A.18.1.4, ISO27001-2013§A.9.2.1, ISO27001-2013§A.9.2.4, ISO27001-2013§A.9.3.1, ISO27001-2013§A.9.4.2, ISO27001-2013§A.9.4.3, NIST§AC-8(a), NIST§AC-8(b), NIST§AC-8(c), NIST-CSF§PR.AC-7, OSPP§FMT_MOF_EXT.1, SRG§SRG-OS-000023-GPOS-00006, SRG§SRG-OS-000024-GPOS-00007, SRG§SRG-OS-000228-GPOS-00088, STIGID§UBTU-20-010002
Description	In the default graphical environment, displaying a login warning banner in the GNOME Display Manager's login screen can be enabled on the login screen by setting `banner-message-enable` to `true`. To enable, add or edit `banner-message-enable` to `/etc/gdm3/greeter.dconf-defaults`. For example: [org/gnome/login-screen] banner-message-enable=true After the settings have been set, run `dconf update`. The banner text must also be set.
Rationale	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. For U.S. Government systems, system use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist.

Set the GNOME3 Login Warning Banner Text

Rule ID	dconf_gnome_login_banner_text
Result	notapplicable
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.10, CIS-CSC§1, CIS-CSC§12, CIS-CSC§15, CIS-CSC§16, COBIT5§DSS05.04, COBIT5§DSS05.10, COBIT5§DSS06.10, CUI§3.1.9, DISA§CCI-000048, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISO27001-2013§A.18.1.4, ISO27001-2013§A.9.2.1, ISO27001-2013§A.9.2.4, ISO27001-2013§A.9.3.1, ISO27001-2013§A.9.4.2, ISO27001-2013§A.9.4.3, NIST§AC-8(a), NIST§AC-8(c), NIST-CSF§PR.AC-7, OSPP§FMT_MOF_EXT.1, SRG§SRG-OS-000023-GPOS-00006, SRG§SRG-OS-000024-GPOS-00007, SRG§SRG-OS-000228-GPOS-00088, STIGID§UBTU-20-010003
Description	In the default graphical environment, configuring the login warning banner text in the GNOME Display Manager's login screen can be configured on the login screen by setting `banner-message-text` to `'APPROVED_BANNER'` where APPROVED_BANNER is the approved banner for your environment. To enable, add or edit `banner-message-text` to `/etc/gdm3/greeter.dconf-defaults`. For example: [org/gnome/login-screen] banner-message-text='APPROVED_BANNER' After the settings have been set, run `dconf update`. When entering a warning banner that spans several lines, remember to begin and end the string with `'` and use `\n` for new lines.
Rationale	An appropriate warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers.

Verify Group Ownership of System Login Banner

Rule ID	file_groupowner_etc_issue
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.8.1.5
Description	To properly set the group owner of `/etc/issue`, run the command: $ sudo chgrp root /etc/issue
Rationale	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper group ownership will ensure that only root user can modify the banner.

Verify Group Ownership of Remote Login Banner

Rule ID	file_groupowner_etc_issue_net
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.8.1.6
Description	To properly set the group owner of `/etc/issue.net`, run the command: $ sudo chgrp root /etc/issue.net
Rationale	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper group ownership will ensure that only root user can modify the banner.

Verify Group Ownership of Message of the Day Banner

Rule ID	file_groupowner_etc_motd
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.8.1.4
Description	To properly set the group owner of `/etc/motd`, run the command: $ sudo chgrp root /etc/motd
Rationale	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper group ownership will ensure that only root user can modify the banner.

Verify ownership of System Login Banner

Rule ID	file_owner_etc_issue
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.8.1.5
Description	To properly set the owner of `/etc/issue`, run the command: $ sudo chown root /etc/issue
Rationale	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper ownership will ensure that only root user can modify the banner.

Verify ownership of Remote Login Banner

Rule ID	file_owner_etc_issue_net
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.8.1.6
Description	To properly set the owner of `/etc/issue.net`, run the command: $ sudo chown root /etc/issue.net
Rationale	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper ownership will ensure that only root user can modify the banner.

Verify ownership of Message of the Day Banner

Rule ID	file_owner_etc_motd
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.8.1.4
Description	To properly set the owner of `/etc/motd`, run the command: $ sudo chown root /etc/motd
Rationale	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper ownership will ensure that only root user can modify the banner.

Verify permissions on System Login Banner

Rule ID	file_permissions_etc_issue
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.8.1.5
Description	To properly set the permissions of `/etc/issue`, run the command: $ sudo chmod 0644 /etc/issue
Rationale	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper permissions will ensure that only root user can modify the banner.

Verify permissions on Remote Login Banner

Rule ID	file_permissions_etc_issue_net
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.8.1.6
Description	To properly set the permissions of `/etc/issue.net`, run the command: $ sudo chmod 0644 /etc/issue.net
Rationale	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper permissions will ensure that only root user can modify the banner.

Verify permissions on Message of the Day Banner

Rule ID	file_permissions_etc_motd
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.8.1.4
Description	To properly set the permissions of `/etc/motd`, run the command: $ sudo chmod 0644 /etc/motd
Rationale	Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Proper permissions will ensure that only root user can modify the banner.

Ensure local login warning banner is configured properly

Rule ID	no_etc_issue_leak
Result	fail
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.8.1.2
Description	The contents of the /etc/issue file are displayed to users priorto login for local terminals. Unix-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If mingetty(8) supports the following options, they display operating system information: \m - machine architecture \r - operating system release \s - operating system name \v - operating system version
Rationale	Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the uname -a command once they have logged in.
Remediation Shell script: (show) `login_banner_text='Authorized uses only. All activity may be monitored and reported.' echo "$login_banner_text" > /etc/issue`

Ensure remote login warning banner is configured properly

Rule ID	no_etc_issue_net_leak
Result	fail
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.8.1.3
Description	The contents of the /etc/issue.net file are displayed to users prior to login for remote connections from configured services. Unix-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If mingetty(8) supports the following options, they display operating system information: \m - machine architecture \r - operating system release \s - operating system name \v - operating system version
Rationale	Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the "uname -a" command once they have logged in.
Remediation Shell script: (show) `login_banner_text='Authorized uses only. All activity may be monitored and reported.' echo "$login_banner_text" > /etc/issue.net`

Ensure message of the day is configured properly

Rule ID	no_etc_motd_leak
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.8.1.1
Description	The contents of the /etc/motd file are displayed to users after login and function as a message of the day for authenticated users. Unix-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If mingetty(8) supports the following options, they display operating system information: \m - machine architecture \r - operating system release \s - operating system name \v - operating system version.
Rationale	Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the " uname -a " command once they have logged in.

Limit Password Reuse

Rule ID	accounts_password_pam_pwhistory_remember
Result	fail
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§5.3.3, DISA§CCI-000200, SRG§SRG-OS-000077-GPOS-00045
Description	Do not allow users to reuse recent passwords. This can be accomplished by using the `remember` option for the `pam_pwhistory` PAM modules. In the file `/etc/pam.d/common-password`, make sure the parameters `remember` is present, and that the value for the `remember` parameter is 5 or greater. For example: password required pam_pwhistory.so ...existing_options... remember=5 The DoD STIG requirement is 5 passwords.
Rationale	Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.
Remediation Shell script: (show) # Remediation is applicable only in certain platforms if dpkg-query --show --showformat='${db:Status-Status}\n' 'libpam-runtime' 2>/dev/null \| grep -q installed; then var_password_pam_remember='5' pamstr=$(egrep '^password\s+required\s+pam_pwhistory\.so\b.\bremember=' /etc/pam.d/common-password) if [ -z "$pamstr" ]; then sed -i "/pam_unix.so/ipassword required pam_pwhistory.so remember=${var_password_pam_remember}" /etc/pam.d/common-password else rememb_val=$(echo -n "$pamstr" \| egrep -o '\bremember=[0-9]+' \| cut -d '=' -f 2) if [ -z "${rememb_val}" ] \|\| [ ${rememb_val} -lt ${var_password_pam_remember} ]; then sed -E -i "s/(^password\s+required\s+pam_pwhistory.so\b.\bremember=)[0-9]/\1${var_password_pam_remember}/" /etc/pam.d/common-password fi fi # Check if we need to add use_authtok first_line=$(grep -n "^password" /etc/pam.d/common-password \| cut -f1 -d: \| head -n 1) pam_pwhistory_line=$(grep -n "pam_pwhistory.so" /etc/pam.d/common-password \| cut -f1 -d: \| head -n 1) if [ $first_line -eq $pam_pwhistory_line ]; then if [[ ! $(egrep "pam_unix.so\b.\buse_authtok" /etc/pam.d/common-password ) ]]; then sed -i "s/pam_unix.so/& use_authtok/" /etc/pam.d/common-password fi else if [[ ! $(egrep "pam_pwhistory.so\b.*\buse_authtok" /etc/pam.d/common-password ) ]]; then sed -E -i 's/pam_pwhistory.so/& use_authtok/' /etc/pam.d/common-password fi fi else >&2 echo 'Remediation is not applicable, nothing was done' fi

Set Deny For Failed Password Attempts

Rule ID accounts_passwords_pam_tally2

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

References: CIS§5.3.2, DISA§CCI-000044, SRG§SRG-OS-000021-GPOS-00005, STIGID§UBTU-20-010072

Description

The Ubuntu 20.04 operating system must lock an account after - at most - 5 consecutive invalid access attempts.

Rationale

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. To configure the operating system to lock an account after three unsuccessful consecutive access attempts using pam_tally2.so, modify the content of both /etc/pam.d/common-auth and /etc/pam.d/common-account as follows:

add or modify the pam_tally2.so module line in /etc/pam.d/common-auth to ensure both onerr=fail and deny=5 are present. For example:
```
auth required pam_tally2.so onerr=fail silent audit deny=5
```
add or modify the following line in /etc/pam.d/common-account:
```
account required pam_tally2.so
```

Remediation Shell script: (show)


var_accounts_passwords_pam_tally2_deny='5'


# Use a non-number regexp to force update of the value of the deny option
function ensure_pam_module_options {
	if [ $# -lt 8 ] || [ $# -gt 9 ] ; then
                echo "$0 requires eight or nine arguments" >&2
                exit 1
        fi
	local _pamFile="$1" _type="$2" _control="$3" _module="$4" _option="$5" _valueRegex="$6" _defaultValue="$7" _position="$8"
	local _remove_argument=""
	if [ $# -eq 9 ] ; then
		_remove_argument="$9"
		# convert it to lowercase
		_remove_argument=${_remove_argument,,}
	fi

	# make sure that we have a line like this in ${_pamFile} (additional options are left as-is):
	# ${_type} ${_control} ${_module} ${_option}=${_valueRegex}

	if ! [ -e "$_pamFile" ] ; then
		echo "$_pamFile doesn't exist" >&2
		exit 1
	fi

	# if remove argument only
	if [ "${_remove_argument}" = "yes" -o "${_remove_argument}" = "true" ] ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+\\S+\\s+${_module}(\\s.+)?)\\s${_option}(=\\S+)?/\\1/" "${_pamFile}"
		exit 0
	fi

	# non-empty values need to be preceded by an equals sign
	[ -n "${_valueRegex}" ] && _valueRegex="=${_valueRegex}"
	# add an equals sign to non-empty values
	[ -n "${_defaultValue}" ] && _defaultValue="=${_defaultValue}"

	# fix 'type' if it's wrong
	if grep -q -P "^\\s*(?"'!'"${_type}\\s)[[:alnum:]]+\\s+[[:alnum:]]+\\s+${_module}" < "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*)[[:alnum:]]+(\\s+[[:alnum:]]+\\s+${_module})/\\1${_type}\\2/" "${_pamFile}"
	fi

	# fix 'control' if it's wrong
	if grep -q -P "^\\s*${_type}\\s+(?"'!'"${_control})[[:alnum:]]+\\s+${_module}" < "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+)[[:alnum:]]+(\\s+${_module})/\\1${_control}\\2/" "${_pamFile}"
	fi

	# fix the value for 'option' if one exists but does not match '_valueRegex'
    if grep -q -P "^\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s+${_option}(?"'!'"${_valueRegex}(\\s|\$))" < "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s)${_option}=[^[:space:]]*/\\1${_option}${_defaultValue}/" "${_pamFile}"

    # add 'option=default' if option is not set
	elif grep -q -E "^\\s*${_type}\\s+${_control}\\s+${_module}" < "${_pamFile}" &&
         grep    -E "^\\s*${_type}\\s+${_control}\\s+${_module}" < "${_pamFile}" | grep -q -E -v "\\s${_option}(=|\\s|\$)" ; then

		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+${_control}\\s+${_module}[^\\n]*)/\\1 ${_option}${_defaultValue}/" "${_pamFile}"
	# add a new entry if none exists
	elif ! grep -q -P "^\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s+${_option}${_valueRegex}(\\s|\$)" < "${_pamFile}" ; then
		if [ "${_position}" = "top" ] ; then
			sed --follow-symlinks -i "/\"Primary\"/i ${_type} ${_control} ${_module} ${_option}${_defaultValue}" "${_pamFile}"
		else
			echo "${_type} ${_control} ${_module} ${_option}${_defaultValue}" >> "${_pamFile}"
        fi
	fi
}
ensure_pam_module_options '/etc/pam.d/common-auth' 'auth' 'required' 'pam_tally2.so' 'deny' '°' "${var_accounts_passwords_pam_tally2_deny}" 'top'
ensure_pam_module_options '/etc/pam.d/common-auth' 'auth' 'required' 'pam_tally2.so' 'onerr' '(fail)' 'fail' 'top'
function ensure_pam_module_options {
	if [ $# -lt 8 ] || [ $# -gt 9 ] ; then
                echo "$0 requires eight or nine arguments" >&2
                exit 1
        fi
	local _pamFile="$1" _type="$2" _control="$3" _module="$4" _option="$5" _valueRegex="$6" _defaultValue="$7" _position="$8"
	local _remove_argument=""
	if [ $# -eq 9 ] ; then
		_remove_argument="$9"
		# convert it to lowercase
		_remove_argument=${_remove_argument,,}
	fi

	# make sure that we have a line like this in ${_pamFile} (additional options are left as-is):
	# ${_type} ${_control} ${_module} ${_option}=${_valueRegex}

	if ! [ -e "$_pamFile" ] ; then
		echo "$_pamFile doesn't exist" >&2
		exit 1
	fi

	# if remove argument only
	if [ "${_remove_argument}" = "yes" -o "${_remove_argument}" = "true" ] ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+\\S+\\s+${_module}(\\s.+)?)\\s${_option}(=\\S+)?/\\1/" "${_pamFile}"
		exit 0
	fi

	# non-empty values need to be preceded by an equals sign
	[ -n "${_valueRegex}" ] && _valueRegex="=${_valueRegex}"
	# add an equals sign to non-empty values
	[ -n "${_defaultValue}" ] && _defaultValue="=${_defaultValue}"

	# fix 'type' if it's wrong
	if grep -q -P "^\\s*(?"'!'"${_type}\\s)[[:alnum:]]+\\s+[[:alnum:]]+\\s+${_module}" < "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*)[[:alnum:]]+(\\s+[[:alnum:]]+\\s+${_module})/\\1${_type}\\2/" "${_pamFile}"
	fi

	# fix 'control' if it's wrong
	if grep -q -P "^\\s*${_type}\\s+(?"'!'"${_control})[[:alnum:]]+\\s+${_module}" < "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+)[[:alnum:]]+(\\s+${_module})/\\1${_control}\\2/" "${_pamFile}"
	fi

	# fix the value for 'option' if one exists but does not match '_valueRegex'
    if grep -q -P "^\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s+${_option}(?"'!'"${_valueRegex}(\\s|\$))" < "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s)${_option}=[^[:space:]]*/\\1${_option}${_defaultValue}/" "${_pamFile}"

    # add 'option=default' if option is not set
	elif grep -q -E "^\\s*${_type}\\s+${_control}\\s+${_module}" < "${_pamFile}" &&
         grep    -E "^\\s*${_type}\\s+${_control}\\s+${_module}" < "${_pamFile}" | grep -q -E -v "\\s${_option}(=|\\s|\$)" ; then

		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+${_control}\\s+${_module}[^\\n]*)/\\1 ${_option}${_defaultValue}/" "${_pamFile}"
	# add a new entry if none exists
	elif ! grep -q -P "^\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s+${_option}${_valueRegex}(\\s|\$)" < "${_pamFile}" ; then
		if [ "${_position}" = "top" ] ; then
			sed --follow-symlinks -i "/\"Primary\"/i ${_type} ${_control} ${_module} ${_option}${_defaultValue}" "${_pamFile}"
		else
			echo "${_type} ${_control} ${_module} ${_option}${_defaultValue}" >> "${_pamFile}"
        fi
	fi
}
ensure_pam_module_options '/etc/pam.d/common-account' 'account' 'required' 'pam_tally2.so' '' '' '' 'bottom'

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Check to see if pam_tally2.so is configured in /etc/pam.d/common-auth
  shell: grep -e '^\s*auth\s\+required\s\+pam_tally2\.so' /etc/pam.d/common-auth ||
    true
  register: check_pam_tally2_result
  tags:
    - DISA-STIG-UBTU-20-010072
    - accounts_passwords_pam_tally2
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure pam_tally2.so module in /etc/pam.d/common-auth
  lineinfile:
    path: /etc/pam.d/common-auth
    line: auth required pam_tally2.so
    state: present
  when: '"pam_tally2" not in check_pam_tally2_result.stdout'
  tags:
    - DISA-STIG-UBTU-20-010072
    - accounts_passwords_pam_tally2
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Check to see if 'onerr' parameter is present
  shell: grep -e '^\s*auth\s\+required\s\+pam_tally2\.so.*\sonerr=.*' /etc/pam.d/common-auth
    || true
  register: check_onerr_result
  tags:
    - DISA-STIG-UBTU-20-010072
    - accounts_passwords_pam_tally2
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Make sure pam_tally2.so has 'onerr' parameter set 'fail'
  replace:
    path: /etc/pam.d/common-auth
    regexp: ^(\s*auth\s+required\s+pam_tally2\.so\s+[^\n]*)(onerr=[A-Za-z]+)([^A-Za-z]?.*)
    replace: \1onerr=fail\3
  register: onerr_update_result
  when: '"onerr=" in check_onerr_result.stdout'
  tags:
    - DISA-STIG-UBTU-20-010072
    - accounts_passwords_pam_tally2
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Add 'onerr' parameter for pam_tally2.so module in /etc/pam.d/common-auth
  lineinfile:
    path: /etc/pam.d/common-auth
    regexp: ^(\s*auth\s+required\s+pam_tally2\.so)((\s+\S+)*\s*(\\)*$)
    line: \1 onerr=fail\2
    backrefs: true
    state: present
  when: '"onerr=" not in check_onerr_result.stdout'
  tags:
    - DISA-STIG-UBTU-20-010072
    - accounts_passwords_pam_tally2
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Check to see if 'deny' parameter is present
  shell: grep -e '^\s*auth\s\+required\s\+pam_tally2\.so.*\sdeny=.*' /etc/pam.d/common-auth
    || true
  register: check_deny_result
  tags:
    - DISA-STIG-UBTU-20-010072
    - accounts_passwords_pam_tally2
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Make sure pam_tally2.so has 'deny' parameter set to less than 4
  replace:
    path: /etc/pam.d/common-auth
    regexp: ^(\s*auth\s+required\s+pam_tally2\.so\s+[^\n]*)deny=([4-9]|[1-9][0-9]+)(\s*.*)
    replace: \1deny=3\3
  when: '"deny=" in check_deny_result.stdout'
  tags:
    - DISA-STIG-UBTU-20-010072
    - accounts_passwords_pam_tally2
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Add 'deny' parameter for pam_tally2.so module in /etc/pam.d/common-auth
  lineinfile:
    path: /etc/pam.d/common-auth
    regexp: ^(\s*auth\s+required\s+pam_tally2\.so)((\s+\S+)*\s*(\\)*$)
    line: \1 deny=3\2
    backrefs: true
    state: present
  when: '"deny=" not in check_deny_result.stdout'
  tags:
    - DISA-STIG-UBTU-20-010072
    - accounts_passwords_pam_tally2
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Check to see if pam_tally2.so is configured in /etc/pam.d/common-account
  shell: grep -e '^\s*account\s\+required\s\+pam_tally2\.so' /etc/pam.d/common-account
    || true
  register: check_account_pam_tally2_result
  tags:
    - DISA-STIG-UBTU-20-010072
    - accounts_passwords_pam_tally2
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure pam_tally2.so module in /etc/pam.d/common-account
  lineinfile:
    path: /etc/pam.d/common-account
    line: account required pam_tally2.so
    state: present
  when: '"pam_tally2" not in check_account_pam_tally2_result.stdout'
  tags:
    - DISA-STIG-UBTU-20-010072
    - accounts_passwords_pam_tally2
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

Ensure PAM Enforces Password Requirements - Minimum Digit Characters

Rule ID accounts_password_pam_dcredit

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

Description

The pam_pwquality module's dcredit parameter controls requirements for usage of digits in a password. When set to a negative number, any password will be required to contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional length credit for each digit. Modify the dcredit setting in /etc/security/pwquality.conf to require the use of a digit in passwords.

Rationale

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring digits makes password guessing attacks more difficult by ensuring a larger search space.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'libpam-runtime' 2>/dev/null | grep -q installed; then


var_password_pam_dcredit='-1'



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^dcredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_dcredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^dcredit\\>" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^dcredit\\>.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/security/pwquality.conf" >> "/etc/security/pwquality.conf"
    printf '%s\n' "$formatted_output" >> "/etc/security/pwquality.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - DISA-STIG-UBTU-20-010052
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_dcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_dcredit # promote to variable
  set_fact:
    var_password_pam_dcredit: !!str -1
  tags:
    - always

- name: Ensure PAM variable dcredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*dcredit
    line: dcredit = {{ var_password_pam_dcredit }}
  when: '"libpam-runtime" in ansible_facts.packages'
  tags:
    - DISA-STIG-UBTU-20-010052
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_dcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters

Rule ID accounts_password_pam_lcredit

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

Description

The pam_pwquality module's lcredit parameter controls requirements for usage of lowercase letters in a password. When set to a negative number, any password will be required to contain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each lowercase character. Modify the lcredit setting in /etc/security/pwquality.conf to require the use of a lowercase character in passwords.

Rationale

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possble combinations that need to be tested before the password is compromised. Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'libpam-runtime' 2>/dev/null | grep -q installed; then


var_password_pam_lcredit='-1'



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^lcredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_lcredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^lcredit\\>" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^lcredit\\>.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/security/pwquality.conf" >> "/etc/security/pwquality.conf"
    printf '%s\n' "$formatted_output" >> "/etc/security/pwquality.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - DISA-STIG-UBTU-20-010051
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_lcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_lcredit # promote to variable
  set_fact:
    var_password_pam_lcredit: !!str -1
  tags:
    - always

- name: Ensure PAM variable lcredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*lcredit
    line: lcredit = {{ var_password_pam_lcredit }}
  when: '"libpam-runtime" in ansible_facts.packages'
  tags:
    - DISA-STIG-UBTU-20-010051
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_lcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure PAM Enforces Password Requirements - Minimum Different Categories

Rule ID accounts_password_pam_minclass

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

Description

The pam_pwquality module's minclass parameter controls requirements for usage of different character classes, or types, of character that must exist in a password before it is considered valid. For example, setting this value to three (3) requires that any password must have characters from at least three different categories in order to be approved. The default value is zero (0), meaning there are no required classes. There are four categories available:

* Upper-case characters
* Lower-case characters
* Digits
* Special characters (for example, punctuation)

Modify the minclass setting in /etc/security/pwquality.conf entry to require 4 differing categories of characters when changing passwords.

Rationale

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Requiring a minimum number of character categories makes password guessing attacks more difficult by ensuring a larger search space.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'libpam-runtime' 2>/dev/null | grep -q installed; then


var_password_pam_minclass='4'



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^minclass")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_minclass"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^minclass\\>" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^minclass\\>.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/security/pwquality.conf" >> "/etc/security/pwquality.conf"
    printf '%s\n' "$formatted_output" >> "/etc/security/pwquality.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_minclass
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_minclass # promote to variable
  set_fact:
    var_password_pam_minclass: !!str 4
  tags:
    - always

- name: Ensure PAM variable minclass is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*minclass
    line: minclass = {{ var_password_pam_minclass }}
  when: '"libpam-runtime" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_minclass
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure PAM Enforces Password Requirements - Minimum Length

Rule ID accounts_password_pam_minlen

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

Description

The pam_pwquality module's minlen parameter controls requirements for minimum characters required in a password. Add minlen=14 after pam_pwquality to set minimum password length requirements.

Rationale

The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromose the password.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'libpam-runtime' 2>/dev/null | grep -q installed; then


var_password_pam_minlen='14'



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^minlen")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_minlen"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^minlen\\>" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^minlen\\>.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/security/pwquality.conf" >> "/etc/security/pwquality.conf"
    printf '%s\n' "$formatted_output" >> "/etc/security/pwquality.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - DISA-STIG-UBTU-20-010054
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_minlen
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_minlen # promote to variable
  set_fact:
    var_password_pam_minlen: !!str 14
  tags:
    - always

- name: Ensure PAM variable minlen is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*minlen
    line: minlen = {{ var_password_pam_minlen }}
  when: '"libpam-runtime" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - DISA-STIG-UBTU-20-010054
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_minlen
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure PAM Enforces Password Requirements - Minimum Special Characters

Rule ID accounts_password_pam_ocredit

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

Description

The pam_pwquality module's ocredit= parameter controls requirements for usage of special (or "other") characters in a password. When set to a negative number, any password will be required to contain that many special characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each special character. Modify the ocredit setting in /etc/security/pwquality.conf to equal -1 to require use of a special character in passwords.

Rationale

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possble combinations that need to be tested before the password is compromised. Requiring a minimum number of special characters makes password guessing attacks more difficult by ensuring a larger search space.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'libpam-runtime' 2>/dev/null | grep -q installed; then


var_password_pam_ocredit='-1'



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^ocredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_ocredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^ocredit\\>" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^ocredit\\>.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/security/pwquality.conf" >> "/etc/security/pwquality.conf"
    printf '%s\n' "$formatted_output" >> "/etc/security/pwquality.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - DISA-STIG-UBTU-20-010055
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_ocredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_ocredit # promote to variable
  set_fact:
    var_password_pam_ocredit: !!str -1
  tags:
    - always

- name: Ensure PAM variable ocredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*ocredit
    line: ocredit = {{ var_password_pam_ocredit }}
  when: '"libpam-runtime" in ansible_facts.packages'
  tags:
    - DISA-STIG-UBTU-20-010055
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_ocredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session

Rule ID accounts_password_pam_retry

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

Description

To configure the number of retry prompts that are permitted per-session: Edit the pam_pwquality.so statement in /etc/pam.d/common-password to show retry=3, or a lower value if site policy is more restrictive. The DoD requirement is a maximum of 3 prompts per session.

Rationale

Setting the password retry prompts that are permitted on a per-session basis to a low value requires some software, such as SSH, to re-connect. This can slow down and draw additional attention to some types of password-guessing attacks. Note that this is different from account lockout, which is provided by the pam_faillock module.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'libpam-runtime' 2>/dev/null | grep -q installed; then


var_password_pam_retry='3'
function ensure_pam_module_options {
	if [ $# -lt 8 ] || [ $# -gt 9 ] ; then
                echo "$0 requires eight or nine arguments" >&2
                exit 1
        fi
	local _pamFile="$1" _type="$2" _control="$3" _module="$4" _option="$5" _valueRegex="$6" _defaultValue="$7" _position="$8"
	local _remove_argument=""
	if [ $# -eq 9 ] ; then
		_remove_argument="$9"
		# convert it to lowercase
		_remove_argument=${_remove_argument,,}
	fi

	# make sure that we have a line like this in ${_pamFile} (additional options are left as-is):
	# ${_type} ${_control} ${_module} ${_option}=${_valueRegex}

	if ! [ -e "$_pamFile" ] ; then
		echo "$_pamFile doesn't exist" >&2
		exit 1
	fi

	# if remove argument only
	if [ "${_remove_argument}" = "yes" -o "${_remove_argument}" = "true" ] ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+\\S+\\s+${_module}(\\s.+)?)\\s${_option}(=\\S+)?/\\1/" "${_pamFile}"
		exit 0
	fi

	# non-empty values need to be preceded by an equals sign
	[ -n "${_valueRegex}" ] && _valueRegex="=${_valueRegex}"
	# add an equals sign to non-empty values
	[ -n "${_defaultValue}" ] && _defaultValue="=${_defaultValue}"

	# fix 'type' if it's wrong
	if grep -q -P "^\\s*(?"'!'"${_type}\\s)[[:alnum:]]+\\s+[[:alnum:]]+\\s+${_module}" < "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*)[[:alnum:]]+(\\s+[[:alnum:]]+\\s+${_module})/\\1${_type}\\2/" "${_pamFile}"
	fi

	# fix 'control' if it's wrong
	if grep -q -P "^\\s*${_type}\\s+(?"'!'"${_control})[[:alnum:]]+\\s+${_module}" < "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+)[[:alnum:]]+(\\s+${_module})/\\1${_control}\\2/" "${_pamFile}"
	fi

	# fix the value for 'option' if one exists but does not match '_valueRegex'
    if grep -q -P "^\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s+${_option}(?"'!'"${_valueRegex}(\\s|\$))" < "${_pamFile}" ; then
		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s)${_option}=[^[:space:]]*/\\1${_option}${_defaultValue}/" "${_pamFile}"

    # add 'option=default' if option is not set
	elif grep -q -E "^\\s*${_type}\\s+${_control}\\s+${_module}" < "${_pamFile}" &&
         grep    -E "^\\s*${_type}\\s+${_control}\\s+${_module}" < "${_pamFile}" | grep -q -E -v "\\s${_option}(=|\\s|\$)" ; then

		sed --follow-symlinks -i -E -e "s/^(\\s*${_type}\\s+${_control}\\s+${_module}[^\\n]*)/\\1 ${_option}${_defaultValue}/" "${_pamFile}"
	# add a new entry if none exists
	elif ! grep -q -P "^\\s*${_type}\\s+${_control}\\s+${_module}(\\s.+)?\\s+${_option}${_valueRegex}(\\s|\$)" < "${_pamFile}" ; then
		if [ "${_position}" = "top" ] ; then
			sed --follow-symlinks -i "/\"Primary\"/i ${_type} ${_control} ${_module} ${_option}${_defaultValue}" "${_pamFile}"
		else
			echo "${_type} ${_control} ${_module} ${_option}${_defaultValue}" >> "${_pamFile}"
        fi
	fi
}
ensure_pam_module_options '/etc/pam.d/common-password' 'password' 'requisite' 'pam_pwquality.so' 'retry' $var_password_pam_retry $var_password_pam_retry 'bottom'

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Strategy:	configure

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.3
    - DISA-STIG-UBTU-20-010057
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_password_pam_retry # promote to variable
  set_fact:
    var_password_pam_retry: !!str 3
  tags:
    - always

- name: Set Password Retry Prompts Permitted Per-Session - system-auth (change)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: (^.*\spam_pwquality.so\s.*retry\s*=\s*)(\S+)(.*$)
    replace: \g<1>{{ var_password_pam_retry }}\g<3>
  when: '"libpam-runtime" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - DISA-STIG-UBTU-20-010057
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Set Password Retry Prompts Permitted Per-Session - system-auth (add)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: ^.*\spam_pwquality.so\s(?!.*retry\s*=\s*).*$
    replace: \g<0> retry={{ var_password_pam_retry }}
  when: '"libpam-runtime" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - DISA-STIG-UBTU-20-010057
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters

Rule ID accounts_password_pam_ucredit

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

Description

The pam_pwquality module's ucredit= parameter controls requirements for usage of uppercase letters in a password. When set to a negative number, any password will be required to contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each uppercase character. Modify the ucredit setting in /etc/security/pwquality.conf to require the use of an uppercase character in passwords.

Rationale

Use of a complex password helps to increase the time and resources reuiqred to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'libpam-runtime' 2>/dev/null | grep -q installed; then


var_password_pam_ucredit='-1'



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^ucredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_ucredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^ucredit\\>" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^ucredit\\>.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/security/pwquality.conf" >> "/etc/security/pwquality.conf"
    printf '%s\n' "$formatted_output" >> "/etc/security/pwquality.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - DISA-STIG-UBTU-20-010050
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_ucredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_ucredit # promote to variable
  set_fact:
    var_password_pam_ucredit: !!str -1
  tags:
    - always

- name: Ensure PAM variable ucredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*ucredit
    line: ucredit = {{ var_password_pam_ucredit }}
  when: '"libpam-runtime" in ansible_facts.packages'
  tags:
    - DISA-STIG-UBTU-20-010050
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_ucredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Install pam_pwquality Package

Rule ID package_pam_pwquality_installed

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

References: DISA§CCI-000366, SRG§SRG-OS-000480-GPOS-00225, STIGID§UBTU-20-010057

Description

The libpam-pwquality package can be installed with the following command:

$ apt-get install libpam-pwquality

Rationale

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	enable


DEBIAN_FRONTEND=noninteractive apt-get install -y "libpam-pwquality"

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Ensure libpam-pwquality is installed
  package:
    name: libpam-pwquality
    state: present
  tags:
    - DISA-STIG-UBTU-20-010057
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_pam_pwquality_installed

Remediation Puppet snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

include install_libpam-pwquality

class install_libpam-pwquality {
  package { 'libpam-pwquality':
    ensure => 'installed',
  }
}

Remediation script: (show)


[[packages]]
name = "libpam-pwquality"
version = "*"

Ensure authentication required for single user mode

Rule ID	single_user_authentication
Result	fail
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§1.5.3
Description	Single user mode is used for recovery when the system detects an issue during boot or by manual selection from the bootloader.
Rationale	Requiring authentication in single user mode prevents an unauthorized user from rebooting the system into single user to gain root privileges without credentials.
Remediation Shell script: (show) `var_root_passwd_hash='' # Only applies the hash to /etc/shadow if the variable contains a value different from '', '!' # or empty if [ -n "${var_root_passwd_hash/+([[:blank:]])/}" ] && [ "${var_root_passwd_hash}" != "" ] &&\ [ "${var_root_passwd_hash}" != "!" ]; then sed -Ei "s@^root:[^:]@root:${var_root_passwd_hash}@" /etc/shadow fi`

Set Account Expiration Following Inactivity

Rule ID account_disable_post_pw_expiration

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

Description

To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct the following line in /etc/default/useradd:

INACTIVE=30

If a password is currently on the verge of expiration, then 30 day(s) remain(s) until the account is automatically disabled. However, if the password will not expire for another 60 days, then 60 days plus 30 day(s) could elapse until the account would be automatically disabled. See the useradd man page for more information.

Rationale

Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'login' 2>/dev/null | grep -q installed; then


var_account_disable_post_pw_expiration='30'



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/default/useradd"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^INACTIVE")

# shellcheck disable=SC2059
printf -v formatted_output "%s=%s" "$stripped_key" "$var_account_disable_post_pw_expiration"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^INACTIVE\\>" "/etc/default/useradd"; then
    "${sed_command[@]}" "s/^INACTIVE\\>.*/$formatted_output/gi" "/etc/default/useradd"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/default/useradd" >> "/etc/default/useradd"
    printf '%s\n' "$formatted_output" >> "/etc/default/useradd"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - DISA-STIG-UBTU-20-010409
    - NIST-800-171-3.5.6
    - NIST-800-53-AC-2(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-4(e)
    - PCI-DSS-Req-8.1.4
    - account_disable_post_pw_expiration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_account_disable_post_pw_expiration # promote to variable
  set_fact:
    var_account_disable_post_pw_expiration: !!str 30
  tags:
    - always

- name: Set Account Expiration Following Inactivity
  lineinfile:
    create: true
    dest: /etc/default/useradd
    regexp: ^INACTIVE
    line: INACTIVE={{ var_account_disable_post_pw_expiration }}
  when: '"login" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - DISA-STIG-UBTU-20-010409
    - NIST-800-171-3.5.6
    - NIST-800-53-AC-2(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-4(e)
    - PCI-DSS-Req-8.1.4
    - account_disable_post_pw_expiration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Set Password Maximum Age

Rule ID accounts_maximum_age_login_defs

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

Description

To specify password maximum age for new accounts, edit the file /etc/login.defs and add or correct the following line:

PASS_MAX_DAYS 365

A value of 180 days is sufficient for many environments. The DoD requirement is 60. The profile requirement is 365.

Rationale

Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.

Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'login' 2>/dev/null | grep -q installed; then


var_accounts_maximum_age_login_defs='365'



grep -q ^PASS_MAX_DAYS /etc/login.defs && \
  sed -i "s/PASS_MAX_DAYS.*/PASS_MAX_DAYS     $var_accounts_maximum_age_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]; then
    echo "PASS_MAX_DAYS      $var_accounts_maximum_age_login_defs" >> /etc/login.defs
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1
    - DISA-STIG-UBTU-20-010008
    - NIST-800-171-3.5.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.4
    - accounts_maximum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_maximum_age_login_defs # promote to variable
  set_fact:
    var_accounts_maximum_age_login_defs: !!str 365
  tags:
    - always

- name: Set Password Maximum Age
  lineinfile:
    create: true
    dest: /etc/login.defs
    regexp: ^#?PASS_MAX_DAYS
    line: PASS_MAX_DAYS {{ var_accounts_maximum_age_login_defs }}
  when: '"login" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1
    - DISA-STIG-UBTU-20-010008
    - NIST-800-171-3.5.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.4
    - accounts_maximum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Set Password Minimum Age

Rule ID accounts_minimum_age_login_defs

Result

fail

Time 2023-09-07T09:13:06

Severity medium

Identifiers and References

Description

To specify password minimum age for new accounts, edit the file /etc/login.defs and add or correct the following line:

PASS_MIN_DAYS 1

A value of 1 day is considered sufficient for many environments. The DoD requirement is 1. The profile requirement is 1.

Rationale

Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.

Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'login' 2>/dev/null | grep -q installed; then


var_accounts_minimum_age_login_defs='1'



grep -q ^PASS_MIN_DAYS /etc/login.defs && \
  sed -i "s/PASS_MIN_DAYS.*/PASS_MIN_DAYS     $var_accounts_minimum_age_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]; then
    echo "PASS_MIN_DAYS      $var_accounts_minimum_age_login_defs" >> /etc/login.defs
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - DISA-STIG-UBTU-20-010007
    - NIST-800-171-3.5.8
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - accounts_minimum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_minimum_age_login_defs # promote to variable
  set_fact:
    var_accounts_minimum_age_login_defs: !!str 1
  tags:
    - always

- name: Set Password Minimum Age
  lineinfile:
    create: true
    dest: /etc/login.defs
    regexp: ^#?PASS_MIN_DAYS
    line: PASS_MIN_DAYS {{ var_accounts_minimum_age_login_defs }}
  when: '"login" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - DISA-STIG-UBTU-20-010007
    - NIST-800-171-3.5.8
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - accounts_minimum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Set Existing Passwords Maximum Age

Rule ID	accounts_password_set_max_life_existing
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§5.4.1.1, DISA§CCI-000199, NIST§IA-5(f), NIST§IA-5(1)(d), NIST§CM-6(a), SRG§SRG-OS-000076-GPOS-00044, VMMSRG§SRG-OS-000076-VMM-000430
Description	Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction by running the following command: $ sudo chage -M 365 USER
Rationale	Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.

Set Existing Passwords Minimum Age

Rule ID	accounts_password_set_min_life_existing
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§5.4.1.2, DISA§CCI-000198, NIST§IA-5(f), NIST§IA-5(1)(d), NIST§CM-6(a), SRG§SRG-OS-000075-GPOS-00043, VMMSRG§SRG-OS-000075-VMM000420
Description	Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime by running the following command: $ sudo chage -m 1 USER
Rationale	Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.

Set Password Warning Age

Rule ID	accounts_password_warn_age_login_defs
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§5.4.1.3, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CIS-CSC§7, CIS-CSC§8, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS05.10, COBIT5§DSS06.03, COBIT5§DSS06.10, CUI§3.5.8, ISA-62443-2009§4.3.3.2.2, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 6.2, ISM§0418, ISM§1055, ISM§1402, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.3, ISO27001-2013§A.18.1.4, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.1, ISO27001-2013§A.9.2.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.2.4, ISO27001-2013§A.9.2.6, ISO27001-2013§A.9.3.1, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.2, ISO27001-2013§A.9.4.3, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§IA-5(f), NIST§IA-5(1)(d), NIST§CM-6(a), NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§PR.AC-1, NIST-CSF§PR.AC-4, NIST-CSF§PR.AC-6, NIST-CSF§PR.AC-7
Description	To specify how many days prior to password expiration that a warning will be issued to users, edit the file `/etc/login.defs` and add or correct the following line: PASS_WARN_AGE 7 The DoD requirement is 7. The profile requirement is `7`.
Rationale	Setting the password warning age enables users to make the change at a practical time.

Ensure all users last password change date is in the past

Rule ID	last_change_date_in_past
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§5.4.1.5
Description	All users should have a password change date in the past.
Rationale	If a users recorded password change date is in the future then they could bypass any set password expiration.

Verify All Account Password Hashes are Shadowed with SHA512

Rule ID	accounts_password_all_shadowed_sha512
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§5.3.4, DISA§CCI-000196, DISA§CCI-000803, NIST§IA-5(1)(c), NIST§IA-5(1).1(v), NIST§IA-7, NIST§IA-7.1, SRG§SRG-OS-000073-GPOS-00041, SRG§SRG-OS-000120-GPOS-00061
Description	Verify the operating system requires the shadow password suite configuration be set to encrypt interactive user passwords using a strong cryptographic hash. Check that the interactive user account passwords are using a strong password hash with the following command: # sudo cut -d: -f2 /etc/shadow $6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/ Password hashes `!` or `*` indicate inactive accounts not available for logon and are not evaluated. If any interactive user password hash does not begin with `$6`, this is a finding.
Rationale	The system must use a strong hashing algorithm to store the password. The system must use a sufficient number of hashing rounds to ensure the required level of entropy.

Ensure all groups in /etc/passwd exist in /etc/group

Rule ID	all_etc_passwd_groups_exist_in_etc_group
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§6.2.12
Description	Over time, system administration errors and changes can lead to groups being defined in /etc/passwd but not in /etc/group . Groups defined in the /etc/passwd file but not in the /etc/group file pose a threat to system security since group permissions are not properly managed.
Rationale	Groups defined in the /etc/passwd file but not in the /etc/group file pose a threat to system security since group permissions are not properly managed.

Ensure shadow group is empty

Rule ID	ensure_shadow_group_empty
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§6.2.17
Description	The shadow group allows system programs which require access the ability to read the /etc/shadow file. No users should be assigned to the shadow group. Any users assigned to the shadow group would be granted read access to the /etc/shadow file. If attackers can gain read access to the /etc/shadow file, they can easily run a password cracking program against the hashed passwords to break them. Other security information that is stored in the /etc/shadow file (such as expiration) could also be useful to subvert additional user accounts.
Rationale	Any users assigned to the shadow group would be granted read access to the /etc/shadow file. If attackers can gain read access to the /etc/shadow file, they can easily run a password cracking program against the hashed passwords to break them. Other security information that is stored in the /etc/shadow file (such as expiration) could also be useful to subvert additional user accounts.

Ensure no duplicate GIDs exist

Rule ID	no_duplicate_gids
Result	pass
Time	2023-09-07T09:13:06
Severity	medium
Identifiers and References	References: CIS§6.2.14
Description	Although the groupadd program will not let you create a duplicate Group ID (GID), it is possible for an administrator to manually edit the /etc/group file and change the GID field. User groups must be assigned unique GIDs for accountability and to ensure appropriate access protections.
Rationale	User groups must be assigned unique GIDs for accountability and to ensure appropriate access protections.

Ensure no duplicate group names exist

Rule ID	no_duplicate_group_names
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.16
Description	Although the groupadd program will not let you create a duplicate group name, it is possible for an administrator to manually edit the /etc/group file and change the group name. If a group is assigned a duplicate group name, it will create and have access to files with the first GID for that group in /etc/group . Effectively, the GID is shared, which is a security problem.
Rationale	If a group is assigned a duplicate group name, it will create and have access to files with the first GID for that group in /etc/group . Effectively, the GID is shared, which is a security problem.

Ensure no duplicate UIDs exist

Rule ID	no_duplicate_uids
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.13
Description	Although the useradd program will not let you create a duplicate User ID (UID), it is possible for an administrator to manually edit the /etc/passwd file and change the UID field. Users must be assigned unique UIDs for accountability and to ensure appropriate access protections.
Rationale	Users must be assigned unique UIDs for accountability and to ensure appropriate access protections.

Ensure no duplicate user names exist

Rule ID	no_duplicate_user_names
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.15
Description	Although the useradd program will not let you create a duplicate user name, it is possible for an administrator to manually edit the /etc/passwd file and change the user name. If a user is assigned a duplicate user name, it will create and have access to files with the first UID for that username in /etc/passwd . For example, if "test4" has a UID of 1000 and a subsequent "test4" entry has a UID of 2000, logging in as "test4" will use UID 1000. Effectively, the UID is shared, which is a security problem.
Rationale	If a user is assigned a duplicate user name, it will create and have access to files with the first UID for that username in /etc/passwd . For example, if "test4" has a UID of 1000 and a subsequent "test4" entry has a UID of 2000, logging in as "test4" will use UID 1000. Effectively, the UID is shared, which is a security problem.

Lock Accounts With Empty Password Field

Rule ID	no_empty_password_field
Result	pass
Time	2023-09-07T09:13:07
Severity	high
Identifiers and References	References: CIS§6.2.1
Description	If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. Lock all accounts with empty password field on /etc/shadow to prevent logins with empty passwords.
Rationale	If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

Ensure users' .netrc Files are not group or world accessible

Rule ID	no_group_world_readable_netrc_files
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.10
Description	While the system administrator can establish secure permissions for users' .netrc files, the users can easily override these. files may contain unencrypted passwords that may be used to attack other systems.
Rationale	.netrc files may contain unencrypted passwords that may be used to attack other systems.

Verify No netrc Files Exist

Rule ID	no_netrc_files
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.9, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS05.10, COBIT5§DSS06.03, COBIT5§DSS06.06, COBIT5§DSS06.10, DISA§CCI-000196, ISA-62443-2009§4.3.3.2.2, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISO27001-2013§A.18.1.4, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.1, ISO27001-2013§A.9.2.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.2.4, ISO27001-2013§A.9.2.6, ISO27001-2013§A.9.3.1, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.2, ISO27001-2013§A.9.4.3, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R1.3, NERC-CIP§CIP-003-3 R3, NERC-CIP§CIP-003-3 R3.1, NERC-CIP§CIP-003-3 R3.2, NERC-CIP§CIP-003-3 R3.3, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.2.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.2, NERC-CIP§CIP-007-3 R5.2, NERC-CIP§CIP-007-3 R5.3.1, NERC-CIP§CIP-007-3 R5.3.2, NERC-CIP§CIP-007-3 R5.3.3, NIST§IA-5(h), NIST§IA-5(1)(c), NIST§CM-6(a), NIST§IA-5(7), NIST-CSF§PR.AC-1, NIST-CSF§PR.AC-4, NIST-CSF§PR.AC-6, NIST-CSF§PR.AC-7, NIST-CSF§PR.PT-3
Description	The `.netrc` files contain login information used to auto-login into FTP servers and reside in the user's home directory. These files may contain unencrypted passwords to remote FTP servers making them susceptible to access by unauthorized users and should not be used. Any `.netrc` files should be removed.
Rationale	Unencrypted passwords for remote FTP servers may be stored in `.netrc` files.

Ensure default group for the root account is GID 0

Rule ID	accounts_no_gid_except_zero
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§5.4.3
Description	The usermod command can be used to specify which group the root user belongs to. This affects permissions of files that are created by the root user. Using GID 0 for the root account helps prevent root-owned files from accidentally becoming accessible to non-privileged users.
Rationale	Using GID 0 for the root account helps prevent root -owned files from accidentally becoming accessible to non-privileged users.

Verify Only Root Has UID 0

Rule ID	accounts_no_uid_except_zero
Result	pass
Time	2023-09-07T09:13:07
Severity	high
Identifiers and References	References: CIS§6.2.2, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS05.10, COBIT5§DSS06.02, COBIT5§DSS06.03, COBIT5§DSS06.10, CUI§3.1.1, CUI§3.1.5, DISA§CCI-000366, ISA-62443-2009§4.3.3.2.2, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.18.1.4, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.1, ISO27001-2013§A.9.2.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.2.4, ISO27001-2013§A.9.2.6, ISO27001-2013§A.9.3.1, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.2, ISO27001-2013§A.9.4.3, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.2.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.2, NERC-CIP§CIP-007-3 R5.2, NERC-CIP§CIP-007-3 R5.3.1, NERC-CIP§CIP-007-3 R5.3.2, NERC-CIP§CIP-007-3 R5.3.3, NIST§IA-2, NIST§AC-6(5), NIST§IA-4(b), NIST-CSF§PR.AC-1, NIST-CSF§PR.AC-4, NIST-CSF§PR.AC-6, NIST-CSF§PR.AC-7, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	If any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed. If the account is associated with system commands or applications the UID should be changed to one greater than "0" but less than "1000." Otherwise assign a UID greater than "1000" that has not already been assigned.
Rationale	An account has root authority if it has a UID of 0. Multiple accounts with a UID of 0 afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner.

Ensure the group used by pam_wheel module exists on system and is empty

Rule ID	ensure_pam_wheel_group_empty
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§5.6
Description	Ensure that the group sugroup referenced by the pam_wheel `group` parameter exists and has no members. This ensures that no user can run commands with altered privileges through the `su` command.
Rationale	The `su` program allows to run commands with a substitute user and group ID. It is commonly used to run commands as the root user. Limiting access to such command is considered a good security practice.
Remediation Shell script: (show) `#!/bin/bash var_pam_wheel_group_for_su='sugroup' GRP_FILE=/etc/group grep -q ^${var_pam_wheel_group_for_su}:[^:]:[^:]:[^:]* /etc/group if [ $? -ne 0 ]; then groupadd ${var_pam_wheel_group_for_su} fi # group must be empty grp_memb=$(groupmems -g ${var_pam_wheel_group_for_su} -l) if [ -n "${grp_memb}" ]; then for memb in ${grp_memb}; do deluser ${memb} ${var_pam_wheel_group_for_su} done fi`

Ensure that System Accounts Do Not Run a Shell Upon Login

Rule ID	no_shelllogin_for_systemaccounts
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§5.4.2, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CIS-CSC§7, CIS-CSC§8, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.03, DISA§CCI-000366, ISA-62443-2009§4.3.3.2.2, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 6.2, ISM§1491, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.1, ISO27001-2013§A.9.2.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.2.4, ISO27001-2013§A.9.2.6, ISO27001-2013§A.9.3.1, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.2, ISO27001-2013§A.9.4.3, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§AC-6, NIST§CM-6(a), NIST§CM-6(b), NIST§CM-6.1(iv), NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§PR.AC-1, NIST-CSF§PR.AC-4, NIST-CSF§PR.AC-6, SRG§SRG-OS-000480-GPOS-00227
Description	Some accounts are not associated with a human user of the system, and exist to perform some administrative function. Should an attacker be able to log into these accounts, they should not be granted access to a shell. The login shell for each local account is stored in the last field of each line in `/etc/passwd`. System accounts are those user accounts with a user ID less than UID_MIN, where value of UID_MIN directive is set in /etc/login.defs configuration file. In the default configuration UID_MIN is set to 1000, thus system accounts are those user accounts with a user ID less than 1000. The user ID is stored in the third field. If any system account SYSACCT (other than root) has a login shell, disable it with the command: $ sudo usermod -s /sbin/nologin SYSACCT
Rationale	Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts.
Warnings	warning Do not perform the steps in this section on the root account. Doing so might cause the system to become inaccessible.

Enforce usage of pam_wheel with group parameter for su authentication

Rule ID	use_pam_wheel_group_for_su
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§5.6
Description	To ensure that only users who are members of the group set in the `group` pam_wheel parameter can run commands with altered privileges through the `su` command, make sure that the following line exists in the file `/etc/pam.d/su`: auth required pam_wheel.so use_uid group=sugroup
Rationale	The `su` program allows to run commands with a substitute user and group ID. It is commonly used to run commands as the root user. Limiting access to such command is considered a good security practice.
Remediation Shell script: (show) #!/bin/bash var_pam_wheel_group_for_su='sugroup' PAM_CONF=/etc/pam.d/su pamstr=$(grep -P '^auth\s+required\s+pam_wheel\.so\s+(?=[^#]\buse_uid\b)(?=[^#]\bgroup=)' ${PAM_CONF}) if [ -z "$pamstr" ]; then sed -Ei '/^auth\b.\brequired\b.\bpam_wheel\.so/d' ${PAM_CONF} # remove any remaining uncommented pam_wheel.so line sed -Ei "/^auth\s+sufficient\s+pam_rootok\.so.$/a auth required pam_wheel.so use_uid group=${var_pam_wheel_group_for_su}" ${PAM_CONF} else group_val=$(echo -n "$pamstr" \| egrep -o '\bgroup=[_a-z][-0-9_a-z]' \| cut -d '=' -f 2) if [ -z "${group_val}" ] \|\| [ ${group_val} != ${var_pam_wheel_group_for_su} ]; then sed -Ei "s/(^auth\s+required\s+pam_wheel.so\s+[^#]group=)[_a-z][-0-9_a-z]/\1${var_pam_wheel_group_for_su}/" ${PAM_CONF} fi fi

Ensure that Root's Path Does Not Include World or Group-Writable Directories

Rule ID	accounts_root_path_dirs_no_write
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.3, CIS-CSC§11, CIS-CSC§3, CIS-CSC§9, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, DISA§CCI-000366, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, NIST§CM-6(a), NIST§CM-6(a), NIST-CSF§PR.IP-1
Description	For each element in root's path, run: # ls -ld DIR and ensure that write permissions are disabled for group and other.
Rationale	Such entries increase the risk that root could execute code provided by unprivileged users, and potentially malicious code.

Ensure the Default Bash Umask is Set Correctly

Rule ID accounts_umask_etc_bashrc

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: ANSSI§BP28(R35), CIS§5.4.4, CIS-CSC§18, COBIT5§APO13.01, COBIT5§BAI03.01, COBIT5§BAI03.02, COBIT5§BAI03.03, DISA§CCI-000366, ISA-62443-2009§4.3.4.3.3, ISO27001-2013§A.14.1.1, ISO27001-2013§A.14.2.1, ISO27001-2013§A.14.2.5, ISO27001-2013§A.6.1.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§AC-6(1), NIST§CM-6(a), NIST-CSF§PR.IP-2, SRG§SRG-OS-000480-GPOS-00228, SRG§SRG-OS-000480-GPOS-00227

Description

To ensure the default umask for users of the Bash shell is set properly, add or correct the umask setting in /etc/bashrc to read as follows:

umask 027

Rationale

The umask value influences the permissions assigned to files when they are created. A misconfigured umask value could result in files with excessive permissions that can be read or written to by unauthorized users.

Remediation Shell script: (show)


var_accounts_user_umask='027'



grep -q umask /etc/bashrc && \
  sed -i "s/umask.*/umask $var_accounts_user_umask/g" /etc/bashrc
if ! [ $? -eq 0 ]; then
    echo "umask $var_accounts_user_umask" >> /etc/bashrc
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str 027
  tags:
    - always

- name: Set user umask in /etc/bashrc
  replace:
    path: /etc/bashrc
    regexp: umask.*
    replace: umask {{ var_accounts_user_umask }}
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_bashrc
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure the Default C Shell Umask is Set Correctly

Rule ID accounts_umask_etc_csh_cshrc

Result

fail

Time 2023-09-07T09:13:07

Severity unknown

Identifiers and References

References: CIS§5.4.4, CIS-CSC§18, COBIT5§APO13.01, COBIT5§BAI03.01, COBIT5§BAI03.02, COBIT5§BAI03.03, DISA§CCI-000366, ISA-62443-2009§4.3.4.3.3, ISO27001-2013§A.14.1.1, ISO27001-2013§A.14.2.1, ISO27001-2013§A.14.2.5, ISO27001-2013§A.6.1.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§AC-6(1), NIST§CM-6(a), NIST-CSF§PR.IP-2, SRG§SRG-OS-000480-GPOS-00228

Description

To ensure the default umask for users of the C shell is set properly, add or correct the umask setting in /etc/csh.cshrc to read as follows:

umask 027

Rationale

Remediation Shell script: (show)


var_accounts_user_umask='027'



grep -q umask /etc/csh.cshrc && \
  sed -i "s/umask.*/umask $var_accounts_user_umask/g" /etc/csh.cshrc
if ! [ $? -eq 0 ]; then
    echo "umask $var_accounts_user_umask" >> /etc/csh.cshrc
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str 027
  tags:
    - always

- name: Set user umask in /etc/csh.cshrc
  replace:
    path: /etc/csh.cshrc
    regexp: umask.*
    replace: umask {{ var_accounts_user_umask }}
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_csh_cshrc
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - unknown_severity

Ensure the Default Umask is Set Correctly in login.defs

Rule ID accounts_umask_etc_login_defs

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

To ensure the default umask controlled by /etc/login.defs is set properly, add or correct the UMASK setting in /etc/login.defs to read as follows:

UMASK 027

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'login' 2>/dev/null | grep -q installed; then


var_accounts_user_umask='027'



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/login.defs"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^UMASK")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$var_accounts_user_umask"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^UMASK\\>" "/etc/login.defs"; then
    "${sed_command[@]}" "s/^UMASK\\>.*/$formatted_output/gi" "/etc/login.defs"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/login.defs" >> "/etc/login.defs"
    printf '%s\n' "$formatted_output" >> "/etc/login.defs"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - DISA-STIG-UBTU-20-010016
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str 027
  tags:
    - always

- name: Ensure the Default UMASK is Set Correctly
  lineinfile:
    create: true
    dest: /etc/login.defs
    regexp: ^UMASK
    line: UMASK {{ var_accounts_user_umask }}
  when: '"login" in ansible_facts.packages'
  tags:
    - DISA-STIG-UBTU-20-010016
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure the Default Umask is Set Correctly in /etc/profile

Rule ID accounts_umask_etc_profile

Result

fail

Time 2023-09-07T09:13:07

Severity unknown

Identifiers and References

Description

To ensure the default umask controlled by /etc/profile is set properly, add or correct the umask setting in /etc/profile to read as follows:

umask 027

Rationale

Remediation Shell script: (show)


var_accounts_user_umask='027'



grep -q umask /etc/profile && \
  sed -i "s/umask.*/umask $var_accounts_user_umask/g" /etc/profile
if ! [ $? -eq 0 ]; then
    echo "umask $var_accounts_user_umask" >> /etc/profile
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str 027
  tags:
    - always

- name: Set user umask in /etc/profile
  replace:
    path: /etc/profile
    regexp: umask.*
    replace: umask {{ var_accounts_user_umask }}
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_profile
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - unknown_severity

Ensure the Default Umask is Set Correctly For Interactive Users

Rule ID	accounts_umask_interactive_users
Result	notchecked
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§5.4.4, DISA§CCI-000366, DISA§CCI-001814, SRG§SRG-OS-000480-GPOS-00227
Description	Remove the `UMASK` environment variable from all interactive users initialization files.
Rationale	The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 700 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be 0. This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.
Evaluation messages info No candidate or applicable check found.

Set Interactive Session Timeout

Rule ID accounts_tmout

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

Setting the TMOUT option in /etc/profile ensures that all user sessions will terminate based on inactivity. The TMOUT setting in a file loaded by /etc/profile, e.g. /etc/profile.d/tmout.sh should read as follows:

TMOUT=600

Rationale

Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


var_accounts_tmout='600'



# if 0, no occurence of tmout found, if 1, occurence found
tmout_found=0

for f in /etc/profile /etc/profile.d/*.sh; do
    if grep --silent '^\s*TMOUT' $f; then
        sed -i -E "s/^(\s*)TMOUT\s*=\s*(\w|\$)*(.*)$/\1TMOUT=$var_accounts_tmout\3/g" $f
        tmout_found=1
    fi
done

if [ $tmout_found -eq 0 ]; then
        echo -e "\n# Set TMOUT to $var_accounts_tmout per security requirements" >> /etc/profile.d/tmout.sh
        echo "TMOUT=$var_accounts_tmout" >> /etc/profile.d/tmout.sh
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_accounts_tmout # promote to variable
  set_fact:
    var_accounts_tmout: !!str 600
  tags:
    - always

- name: Set Interactive Session Timeout
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/profile.d/tmout.sh
        create: false
        regexp: ^\s*TMOUT=
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/profile.d/tmout.sh
      lineinfile:
        path: /etc/profile.d/tmout.sh
        create: false
        regexp: ^\s*TMOUT=
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/profile.d/tmout.sh
      lineinfile:
        path: /etc/profile.d/tmout.sh
        create: true
        regexp: ^\s*TMOUT=
        line: TMOUT={{ var_accounts_tmout }}
        state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010013
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - accounts_tmout
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

User Initialization Files Must Be Owned By the Primary User

Rule ID	accounts_user_dot_user_ownership
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.7, DISA§CCI-000366, SRG§SRG-OS-000480-GPOS-00227
Description	Set the owner of the user initialization files for interactive users to the primary owner with the following command: $ sudo chown USER /home/USER/.*
Rationale	Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.

All Interactive Users Home Directories Must Exist

Rule ID	accounts_user_interactive_home_directory_exists
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.4, DISA§CCI-000366, SRG§SRG-OS-000480-GPOS-00227
Description	Create home directories to all interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in `/etc/passwd`: $ sudo mkdir /home/USER
Rationale	If a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a Denial of Service because the user would not be able to access their logon configuration files, and it may give them visibility to system files they normally would not be able to access.

Ensure users own their home directories

Rule ID	accounts_users_own_home_directories
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.6
Description	The user home directory is space defined for the particular user to set local environment variables and to store personal files. Since the user is accountable for files stored in the user home directory, the user must be the owner of the directory.
Rationale	Since the user is accountable for files stored in the user home directory, the user must be the owner of the directory.

Ensure appropriate umask set for adduser

Rule ID	adduser_home_directories_mode
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.5
Description	While the system administrator can establish secure permissions for users' home directories, the users can easily override these. Setting DIRMODE=0750 for adduser helps ensure safe default permissions are chosen.
Rationale	Group or world-writable user home directories may enable malicious users to steal or modify other users' data or to gain another user's system privileges.
Remediation Shell script: (show) `var_adduser_home_directories_mode='0750' valid_mode=${var_adduser_home_directories_mode} adduser_conf=/etc/adduser.conf dir_mode="$(awk -F= '/^\sDIR_MODE\s=\s[0-7]?[0-7]{3}/{ printf("%04d", strtonum($2)) }' ${adduser_conf})" if [ -z "${dir_mode}" ] \|\| [ $(( $dir_mode & 0$valid_mode )) -ne "${dir_mode}" ]; then sed -i '/^\sDIR_MODE\b/d' ${adduser_conf} echo 'DIR_MODE='"${valid_mode}" >> ${adduser_conf} fi`

All Interactive User Home Directories Must Have mode 0750 Or Less Permissive

Rule ID	file_permissions_home_directories
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.5, DISA§CCI-000366, SRG§SRG-OS-000480-GPOS-00227
Description	Change the mode of interactive users home directories to `0750`. To change the mode of interactive users home directory, use the following command: $ sudo chmod 0750 /home/USER
Rationale	Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.
Remediation Shell script: (show) `# Return user name and their respective home directory, separated by a single " " fetch_users_and_homedir() { cat /etc/passwd \| egrep -v '^(halt\|sync\|shutdown)' \|\ awk -F: '($7 != "/usr/sbin/nologin" && $7 != "/bin/false" && $3 >= 1000)\ { print $1 " " $6 }' } fetch_users_and_homedir \|\ while read user dir; do chmod o-wrx,g-w "${dir}" done`

Ensure no users have .forward files

Rule ID	no_forward_files
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.8
Description	The .forward file specifies an email address to forward the user's mail to. Use of the .forward file poses a security risk in that sensitive data may be inadvertently transferred outside the organization. The .forward file also poses a risk as it can be used to execute commands that may perform unintended actions.
Rationale	Use of the .forward file poses a security risk in that sensitive data may be inadvertently transferred outside the organization. The .forward file also poses a risk as it can be used to execute commands that may perform unintended actions.

Ensure users' dot files are not group or world writable

Rule ID	no_group_world_writable_dot_files
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.7
Description	While the system administrator can establish secure permissions for users' "dot" files, the users can easily override these. Group or world-writable user configuration files may enable malicious users to steal or modify other users' data or to gain another user's system privileges.
Rationale	Group or world-writable user configuration files may enable malicious users to steal or modify other users' data or to gain another user's system privileges.

Ensure appropriate homedir mode set for useradd

Rule ID	useradd_home_directories_mode
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§6.2.5
Description	While the system administrator can establish secure permissions for users' home directories, the users can easily override these. Setting HOME_MODE=750 on /etc/login.defs for useradd helps ensure safe default permissions are chosen.
Rationale	Group or world-writable user home directories may enable malicious users to steal or modify other users' data or to gain another user's system privileges.
Remediation Shell script: (show) `var_useradd_home_directories_mode='0750' valid_mode=${var_useradd_home_directories_mode} useradd_conf=/etc/login.defs home_mode="$(awk -F= '/^\sHOME_MODE\s=\s[0-7]?[0-7]{3}/{ printf("%04d", strtonum($2)) }' ${useradd_conf})" if [ -z "${home_mode}" ] \|\| [ $(( $home_mode & 0$valid_mode )) -ne "${home_mode}" ]; then sed -i '/^\sHOME_MODE\b/d' ${useradd_conf} echo -e 'HOME_MODE\t'"${valid_mode}" >> ${useradd_conf} fi`

Record Events that Modify the System's Discretionary Access Controls - chmod

Rule ID audit_rules_dac_modification_chmod

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

At a minimum, the audit system should collect file permission changes for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:

-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod

Rationale

The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.

Warnings

warning Note that these rules can be configured in a number of ways while still achieving the desired effect. Here the system calls have been placed independent of other system calls. Grouping these system calls with others as identifying earlier in this guide is more efficient.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="chmod"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit chmod tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010152
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chmod for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of chmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of chmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010152
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chmod for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of chmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of chmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010152
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Discretionary Access Controls - chown

Rule ID audit_rules_dac_modification_chown

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod

Rationale

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="chown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit chown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010148
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chown for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010148
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chown for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010148
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Discretionary Access Controls - fchmod

Rule ID audit_rules_dac_modification_fchmod

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod

Rationale

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="fchmod"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit fchmod tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010153
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmod for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010153
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmod for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010153
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Discretionary Access Controls - fchmodat

Rule ID audit_rules_dac_modification_fchmodat

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod

Rationale

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="fchmodat"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit fchmodat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010154
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmodat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmodat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010154
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmodat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmodat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010154
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Discretionary Access Controls - fchown

Rule ID audit_rules_dac_modification_fchown

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod

Rationale

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="fchown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit fchown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010149
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchown for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010149
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchown for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010149
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Discretionary Access Controls - fchownat

Rule ID audit_rules_dac_modification_fchownat

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod

Rationale

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="fchownat"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit fchownat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010150
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchownat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010150
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchownat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010150
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Discretionary Access Controls - fremovexattr

Rule ID audit_rules_dac_modification_fremovexattr

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.9, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.4.1.1, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI08.02, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.AC-3, NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, OSPP§FAU_GEN.1.1.c, PCIDSS§Req-10.5.5, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000458-GPOS-00203, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000463-GPOS-00207, SRG§SRG-OS-000471-GPOS-00215, SRG§SRG-OS-000474-GPOS-00219, SRG§SRG-OS-000466-GPOS-00210, SRG§SRG-OS-000064-GPOS-00033, STIGID§UBTU-20-010147, VMMSRG§SRG-OS-000458-VMM-001810, VMMSRG§SRG-OS-000474-VMM-001940

Description

At a minimum, the audit system should collect file permission changes for all users and root.

If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:

-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

Rationale

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="fremovexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done



for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid=0"
	SYSCALL="fremovexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit fremovexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010147
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010147
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010147
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Discretionary Access Controls - fsetxattr

Rule ID audit_rules_dac_modification_fsetxattr

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod

Rationale

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="fsetxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done



for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid=0"
	SYSCALL="fsetxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit fsetxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010144
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010144
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010144
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Discretionary Access Controls - lchown

Rule ID audit_rules_dac_modification_lchown

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=unset -F key=perm_mod

Rationale

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="lchown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit lchown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010151
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lchown for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010151
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lchown for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010151
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Discretionary Access Controls - lremovexattr

Rule ID audit_rules_dac_modification_lremovexattr

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.9, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.4.1.1, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI08.02, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.AC-3, NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, OSPP§FAU_GEN.1.1.c, PCIDSS§Req-10.5.5, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000458-GPOS-00203, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000463-GPOS-00207, SRG§SRG-OS-000468-GPOS-00212, SRG§SRG-OS-000471-GPOS-00215, SRG§SRG-OS-000474-GPOS-00219, SRG§SRG-OS-000466-GPOS-00210, SRG§SRG-OS-000064-GPOS-00033, STIGID§UBTU-20-010146, VMMSRG§SRG-OS-000458-VMM-001810, VMMSRG§SRG-OS-000474-VMM-001940

Description

At a minimum, the audit system should collect file permission changes for all users and root.

If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:

-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

Rationale

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="lremovexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done



for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid=0"
	SYSCALL="lremovexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit lremovexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010146
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010146
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010146
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Discretionary Access Controls - lsetxattr

Rule ID audit_rules_dac_modification_lsetxattr

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=unset -F key=perm_mod

Rationale

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="lsetxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done



for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid=0"
	SYSCALL="lsetxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit lsetxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010143
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010143
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010143
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Discretionary Access Controls - removexattr

Rule ID audit_rules_dac_modification_removexattr

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.9, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.4.1.1, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI08.02, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.AC-3, NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, OSPP§FAU_GEN.1.1.c, PCIDSS§Req-10.5.5, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000458-GPOS-00203, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000463-GPOS-00207, SRG§SRG-OS-000468-GPOS-00212, SRG§SRG-OS-000471-GPOS-00215, SRG§SRG-OS-000474-GPOS-00219, SRG§SRG-OS-000466-GPOS-00210, SRG§SRG-OS-000064-GPOS-00033, STIGID§UBTU-20-010145, VMMSRG§SRG-OS-000458-VMM-001810, VMMSRG§SRG-OS-000474-VMM-001940

Description

At a minimum, the audit system should collect file permission changes for all users and root.

If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:

-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

Rationale

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="removexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done



for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid=0"
	SYSCALL="removexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit removexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010145
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for removexattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010145
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for removexattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010145
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Discretionary Access Controls - setxattr

Rule ID audit_rules_dac_modification_setxattr

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=unset -F key=perm_mod

Rationale

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="setxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done



for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid=0"
	SYSCALL="setxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit setxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010142
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for setxattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010142
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for setxattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid=0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid=0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid=0 -F
          key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010142
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Ensure auditd Collects File Deletion Events by User - rename

Rule ID audit_rules_file_deletion_events_rename

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

At a minimum, the audit system should collect file deletion events for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as appropriate for your system:

-a always,exit -F arch=ARCH -S rename -F auid>=1000 -F auid!=unset -F key=delete

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file, setting ARCH to either b32 or b64 as appropriate for your system:

-a always,exit -F arch=ARCH -S rename -F auid>=1000 -F auid!=unset -F key=delete

Rationale

Auditing file deletions will create an audit trail for files that are removed from the system. The audit trail could aid in system troubleshooting, as well as, detecting malicious processes that attempt to delete log files to conceal their presence.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="rename"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit rename tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010269
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rename for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rename in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rename in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010269
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rename for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rename in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rename in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010269
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Ensure auditd Collects File Deletion Events by User - renameat

Rule ID audit_rules_file_deletion_events_renameat

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=ARCH -S renameat -F auid>=1000 -F auid!=unset -F key=delete

-a always,exit -F arch=ARCH -S renameat -F auid>=1000 -F auid!=unset -F key=delete

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="renameat"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit renameat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010270
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for renameat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of renameat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of renameat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010270
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for renameat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of renameat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of renameat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010270
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Ensure auditd Collects File Deletion Events by User - unlink

Rule ID audit_rules_file_deletion_events_unlink

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=ARCH -S unlink -F auid>=1000 -F auid!=unset -F key=delete

-a always,exit -F arch=ARCH -S unlink -F auid>=1000 -F auid!=unset -F key=delete

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="unlink"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit unlink tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010267
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlink for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlink in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlink in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010267
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlink for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlink in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlink in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010267
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Ensure auditd Collects File Deletion Events by User - unlinkat

Rule ID audit_rules_file_deletion_events_unlinkat

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=ARCH -S unlinkat -F auid>=1000 -F auid!=unset -F key=delete

-a always,exit -F arch=ARCH -S unlinkat -F auid>=1000 -F auid!=unset -F key=delete

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="unlinkat"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit unlinkat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010268
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlinkat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlinkat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010268
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlinkat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlinkat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010268
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Unsuccessful Access Attempts to Files - creat

Rule ID audit_rules_unsuccessful_file_modification_creat

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.10, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI08.02, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.AC-3, NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, OSPP§FAU_GEN.1.1.c, PCIDSS§Req-10.2.4, PCIDSS§Req-10.2.1, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, SRG§SRG-OS-000458-GPOS-00203, SRG§SRG-OS-000461-GPOS-00205, SRG§SRG-OS-000474-GPOS-00219, STIGID§UBTU-20-010158, VMMSRG§SRG-OS-000458-VMM-001810, VMMSRG§SRG-OS-000461-VMM-001830

Description

At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d:

-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the system is 64 bit then also add the following lines:

-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the system is 64 bit then also add the following lines:

-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

Rationale

Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL="creat"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit creat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010158
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for creat EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010158
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for creat EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010158
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for creat EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010158
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for creat EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010158
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Unsuccessful Access Attempts to Files - ftruncate

Rule ID audit_rules_unsuccessful_file_modification_ftruncate

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.10, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI08.02, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.AC-3, NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, OSPP§FAU_GEN.1.1.c, PCIDSS§Req-10.2.4, PCIDSS§Req-10.2.1, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, SRG§SRG-OS-000458-GPOS-00203, SRG§SRG-OS-000461-GPOS-00205, SRG§SRG-OS-000474-GPOS-00219, STIGID§UBTU-20-010157, VMMSRG§SRG-OS-000458-VMM-001810, VMMSRG§SRG-OS-000461-VMM-001830

Description

-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the system is 64 bit then also add the following lines:

-a always,exit -F arch=b64 -S ftruncate -F exiu=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the system is 64 bit then also add the following lines:

-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

Rationale

Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL="ftruncate"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit ftruncate tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010157
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010157
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010157
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010157
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010157
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Unsuccessful Access Attempts to Files - open

Rule ID audit_rules_unsuccessful_file_modification_open

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.10, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI08.02, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.AC-3, NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, OSPP§FAU_GEN.1.1.c, PCIDSS§Req-10.2.4, PCIDSS§Req-10.2.1, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000458-GPOS-00203, SRG§SRG-OS-000461-GPOS-00205, SRG§SRG-OS-000474-GPOS-00219, STIGID§UBTU-20-010155, VMMSRG§SRG-OS-000458-VMM-001810, VMMSRG§SRG-OS-000461-VMM-001830

Description

-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the system is 64 bit then also add the following lines:

-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the system is 64 bit then also add the following lines:

-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

Rationale

Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL="open"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit open tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010155
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010155
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010155
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010155
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010155
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Unsuccessful Access Attempts to Files - openat

Rule ID audit_rules_unsuccessful_file_modification_openat

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.10, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI08.02, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.AC-3, NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, OSPP§FAU_GEN.1.1.c, PCIDSS§Req-10.2.4, PCIDSS§Req-10.2.1, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, SRG§SRG-OS-000474-GPOS-00219, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000458-GPOS-00203, SRG§SRG-OS-000461-GPOS-00205, STIGID§UBTU-20-010159, VMMSRG§SRG-OS-000458-VMM-001810, VMMSRG§SRG-OS-000461-VMM-001830

Description

-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the system is 64 bit then also add the following lines:

-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the system is 64 bit then also add the following lines:

-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

Rationale

Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL="openat"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit openat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010159
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010159
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010159
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010159
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010159
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Unsuccessful Access Attempts to Files - truncate

Rule ID audit_rules_unsuccessful_file_modification_truncate

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the system is 64 bit then also add the following lines:

-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

If the system is 64 bit then also add the following lines:

-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

Rationale

Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.

Warnings

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL="truncate"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit truncate tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010156
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for truncate EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010156
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for truncate EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010156
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for truncate EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010156
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for truncate EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid>=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010156
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Ensure auditd Collects Information on Kernel Module Unloading - delete_module

Rule ID audit_rules_kernel_module_loading_delete

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.16, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI08.02, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§AC-6(9), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.AC-3, NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, OSPP§FAU_GEN.1.1.c, PCIDSS§Req-10.2.7, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, SRG§SRG-OS-000471-GPOS-00216, SRG§SRG-OS-000477-GPOS-00222, STIGID§UBTU-20-010302, VMMSRG§SRG-OS-000477-VMM-001970

Description

To capture kernel module unloading events, use following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:

-a always,exit -F arch=ARCH -S delete_module -F key=modules

Place to add the line depends on a way auditd daemon is configured. If it is configured to use the augenrules program (the default), add the line to a file with suffix .rules in the directory /etc/audit/rules.d. If the auditd daemon is configured to use the auditctl utility, add the line to file /etc/audit/audit.rules.

Rationale

The removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =>
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS=""
	SYSCALL="delete_module"
	KEY="modules"
	SYSCALL_GROUPING="delete_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Set architecture for audit delete_module tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010302
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_delete
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Perform remediation of Audit rules for delete_module for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - delete_module
        syscall_grouping: []

    - name: Check existence of delete_module in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/module-change.rules
      set_fact: audit_file="/etc/audit/rules.d/module-change.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=module-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - delete_module
        syscall_grouping: []

    - name: Check existence of delete_module in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=module-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010302
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_delete
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Perform remediation of Audit rules for delete_module for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - delete_module
        syscall_grouping: []

    - name: Check existence of delete_module in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/module-change.rules
      set_fact: audit_file="/etc/audit/rules.d/module-change.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=module-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - delete_module
        syscall_grouping: []

    - name: Check existence of delete_module in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=module-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010302
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_delete
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

Ensure auditd Collects Information on Kernel Module Loading - init_module

Rule ID audit_rules_kernel_module_loading_init

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

To capture kernel module loading events, use following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:

-a always,exit -F arch=ARCH -S init_module -F key=modules

Rationale

The addition of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =>
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS=""
	SYSCALL="init_module"
	KEY="modules"
	SYSCALL_GROUPING="init_module finit_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Set architecture for audit init_module tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010179
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_init
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Perform remediation of Audit rules for init_module for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - init_module
        syscall_grouping:
          - init_module
          - finit_module

    - name: Check existence of init_module in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/module-change.rules
      set_fact: audit_file="/etc/audit/rules.d/module-change.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=module-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - init_module
        syscall_grouping:
          - init_module
          - finit_module

    - name: Check existence of init_module in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=module-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010179
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_init
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Perform remediation of Audit rules for init_module for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - init_module
        syscall_grouping:
          - init_module
          - finit_module

    - name: Check existence of init_module in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/module-change.rules
      set_fact: audit_file="/etc/audit/rules.d/module-change.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=module-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - init_module
        syscall_grouping:
          - init_module
          - finit_module

    - name: Check existence of init_module in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=module-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - DISA-STIG-UBTU-20-010179
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_init
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

Record Attempts to Alter Logon and Logout Events - faillog

Rule ID audit_rules_login_events_faillog

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.7, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000470-GPOS-00214, SRG§SRG-OS-000473-GPOS-00218, STIGID§UBTU-20-010170

Description

The audit system already collects login information for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d in order to watch for attempted manual edits of files involved in storing logon events:

-w /var/log/faillog -p wa -k logins

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file in order to watch for unattempted manual edits of files involved in storing logon events:

-w /var/log/faillog -p wa -k logins

Rationale

Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/var/log/faillog" "wa" "logins"
fix_audit_watch_rule "augenrules" "/var/log/faillog" "wa" "logins"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k logins$
    patterns: '*.rules'
  register: find_faillog
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010170
    - audit_rules_login_events_faillog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/logins.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/logins.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_faillog.matched is defined and find_faillog.matched == 0
  tags:
    - DISA-STIG-UBTU-20-010170
    - audit_rules_login_events_faillog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_faillog.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_faillog.matched is defined and find_faillog.matched > 0
  tags:
    - DISA-STIG-UBTU-20-010170
    - audit_rules_login_events_faillog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the faillog rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/faillog -p wa -k logins
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010170
    - audit_rules_login_events_faillog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the faillog rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/faillog -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010170
    - audit_rules_login_events_faillog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Attempts to Alter Logon and Logout Events - lastlog

Rule ID audit_rules_login_events_lastlog

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.7, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI08.02, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000126, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§AC-6(9), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.AC-3, NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, OSPP§FAU_GEN.1.1.c, PCIDSS§Req-10.2.3, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, SRG§SRG-OS-000473-GPOS-00218, SRG§SRG-OS-000470-GPOS-00214, STIGID§UBTU-20-010171, VMMSRG§SRG-OS-000473-VMM-001930, VMMSRG§SRG-OS-000470-VMM-001900

Description

-w /var/log/lastlog -p wa -k logins

-w /var/log/lastlog -p wa -k logins

Rationale

Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/var/log/lastlog" "wa" "logins"
fix_audit_watch_rule "augenrules" "/var/log/lastlog" "wa" "logins"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k logins$
    patterns: '*.rules'
  register: find_lastlog
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010171
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/logins.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/logins.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lastlog.matched is defined and find_lastlog.matched == 0
  tags:
    - DISA-STIG-UBTU-20-010171
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_lastlog.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_lastlog.matched is defined and find_lastlog.matched > 0
  tags:
    - DISA-STIG-UBTU-20-010171
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lastlog rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/lastlog -p wa -k logins
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010171
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the lastlog rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/lastlog -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010171
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Attempts to Alter Logon and Logout Events - tallylog

Rule ID audit_rules_login_events_tallylog

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-w /var/log/tallylog -p wa -k logins

-w /var/log/tallylog -p wa -k logins

Rationale

Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/var/log/tallylog" "wa" "logins"
fix_audit_watch_rule "augenrules" "/var/log/tallylog" "wa" "logins"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k logins$
    patterns: '*.rules'
  register: find_tallylog
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010169
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/logins.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/logins.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_tallylog.matched is defined and find_tallylog.matched == 0
  tags:
    - DISA-STIG-UBTU-20-010169
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_tallylog.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_tallylog.matched is defined and find_tallylog.matched > 0
  tags:
    - DISA-STIG-UBTU-20-010169
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the tallylog rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/tallylog -p wa -k logins
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010169
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the tallylog rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/tallylog -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010169
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_login_events_tallylog
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - at

Rule ID audit_rules_privileged_commands_at

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.11, DISA§CCI-000172, NIST§AU-2(d), NIST§AU-12(c), NIST§AC-6(9), NIST§CM-6(a), OSPP§FAU_GEN.1.1.c, VMMSRG§SRG-OS-000471-VMM-001910

Description

At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix .rules in the directory /etc/audit/rules.d:

-a always,exit -F path=/usr/bin/at -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/at -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threats.

Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/at -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/at
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/at -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/at -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/at -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/at -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/at -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/at -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_at
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - chage

Rule ID audit_rules_privileged_commands_chage

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/chage -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/chage
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chage -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chage -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chage -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010175
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - chfn

Rule ID audit_rules_privileged_commands_chfn

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.11, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, NIST§AU-3, NIST§AU-12(a), NIST§AU-12(c), NIST§MA-4(1)(a), STIGID§UBTU-20-010137

Description

-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter).

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/chfn -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/chfn
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chfn -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chfn -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chfn -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chfn -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chfn -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chfn -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010137
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-3
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_chfn
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - chsh

Rule ID audit_rules_privileged_commands_chsh

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.11, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§BAI03.05, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000135, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, NERC-CIP§CIP-004-3 R2.2.2, NERC-CIP§CIP-004-3 R2.2.3, NERC-CIP§CIP-007-3 R.1.3, NERC-CIP§CIP-007-3 R5, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.3, NERC-CIP§CIP-007-3 R5.2.1, NERC-CIP§CIP-007-3 R5.2.3, NIST§AC-2(4), NIST§AU-2(d), NIST§AU-12(c), NIST§AC-6(9), NIST§CM-6(a), NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.PT-1, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, STIGID§UBTU-20-010163, VMMSRG§SRG-OS-000471-VMM-001910

Description

-a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/chsh -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/chsh
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chsh -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chsh -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chsh -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chsh -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chsh -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chsh -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010163
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chsh
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - crontab

Rule ID audit_rules_privileged_commands_crontab

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/crontab -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/crontab
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/crontab -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/crontab -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/crontab -F
          auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/crontab -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/crontab -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/crontab -F
          auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010177
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_crontab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd

Rule ID audit_rules_privileged_commands_gpasswd

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/gpasswd -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/gpasswd
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/gpasswd -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/gpasswd -F
          auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/gpasswd -F
          auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010174
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_gpasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - insmod

Rule ID audit_rules_privileged_commands_insmod

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.16, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, NIST§AU-12(c), NIST§AU-12.1(iv), NIST§AU-3, NIST§AU-3.1, NIST§AU-12(a), NIST§AU-12.1(ii), NIST§MA-4(1)(a), SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215

Description

-w /sbin/insmod -p x -k modules

Rationale

Remediation Shell script: (show)

Complexity:	low
Disruption:	low

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/sbin/insmod" "x" "modules"
fix_audit_watch_rule "augenrules" "/sbin/insmod" "x" "modules"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Check if watch rule for /sbin/insmod already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/sbin/insmod\s+-p\s+x(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_insmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key modules
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)modules$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_insmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/modules.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modules.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_insmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_insmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /sbin/insmod in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /sbin/insmod -p x -k modules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_insmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /sbin/insmod already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/sbin/insmod\s+-p\s+x(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_insmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /sbin/insmod in /etc/audit/audit.rules
  lineinfile:
    line: -w /sbin/insmod -p x -k modules
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_insmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - modprobe

Rule ID audit_rules_privileged_commands_modprobe

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.16, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, NIST§AU-12(a), NIST§AU-12.1(ii), NIST§AU-3, NIST§AU-3.1, NIST§AU-12(c), NIST§AU-12.1(iv), NIST§MA-4(1)(a), SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, SRG§SRG-OS-000477-GPOS-00222, STIGID§UBTU-20-010296

Description

-w /sbin/modprobe -p x -k modules

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-w /sbin/modprobe -p x -k modules

Rationale

Remediation Shell script: (show)

Complexity:	low
Disruption:	low

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/sbin/modprobe" "x" "modules"
fix_audit_watch_rule "augenrules" "/sbin/modprobe" "x" "modules"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Check if watch rule for /sbin/modprobe already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/sbin/modprobe\s+-p\s+x(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010296
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_modprobe
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key modules
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)modules$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - DISA-STIG-UBTU-20-010296
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_modprobe
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/modules.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modules.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - DISA-STIG-UBTU-20-010296
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_modprobe
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - DISA-STIG-UBTU-20-010296
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_modprobe
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /sbin/modprobe in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /sbin/modprobe -p x -k modules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - DISA-STIG-UBTU-20-010296
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_modprobe
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /sbin/modprobe already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/sbin/modprobe\s+-p\s+x(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010296
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_modprobe
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /sbin/modprobe in /etc/audit/audit.rules
  lineinfile:
    line: -w /sbin/modprobe -p x -k modules
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - DISA-STIG-UBTU-20-010296
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_modprobe
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - mount

Rule ID audit_rules_privileged_commands_mount

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.11, DISA§CCI-000135, DISA§CCI-000172, DISA§CCI-002884, NIST§AU-2(d), NIST§AU-12(c), NIST§AC-6(9), NIST§CM-6(a), OSPP§FAU_GEN.1.1.c, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, STIGID§UBTU-20-010138, VMMSRG§SRG-OS-000471-VMM-001910

Description

-a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/mount -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/mount
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/mount -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/mount -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/mount -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010138
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_mount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap

Rule ID audit_rules_privileged_commands_newgidmap

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.11, DISA§CCI-000172, NERC-CIP§CIP-004-3 R2.2.2, NERC-CIP§CIP-004-3 R2.2.3, NERC-CIP§CIP-007-3 R.1.3, NERC-CIP§CIP-007-3 R5, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.3, NERC-CIP§CIP-007-3 R5.2.1, NERC-CIP§CIP-007-3 R5.2.3, NIST§AC-2(4), NIST§AU-2(d), NIST§AU-12(c), NIST§AC-6(9), NIST§CM-6(a), OSPP§FAU_GEN.1.1.c, VMMSRG§SRG-OS-000471-VMM-001910

Description

-a always,exit -F path=/usr/bin/newgidmap -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/newgidmap -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/newgidmap -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/newgidmap
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newgidmap -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newgidmap -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newgidmap
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newgidmap -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newgidmap -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newgidmap
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - newgrp

Rule ID audit_rules_privileged_commands_newgrp

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.11, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§BAI03.05, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000135, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, NERC-CIP§CIP-004-3 R2.2.2, NERC-CIP§CIP-004-3 R2.2.3, NERC-CIP§CIP-007-3 R.1.3, NERC-CIP§CIP-007-3 R5, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.3, NERC-CIP§CIP-007-3 R5.2.1, NERC-CIP§CIP-007-3 R5.2.3, NIST§AC-2(4), NIST§AU-2(d), NIST§AU-12(c), NIST§AC-6(9), NIST§CM-6(a), NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.PT-1, OSPP§FAU_GEN.1.1.c, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, STIGID§UBTU-20-010164, VMMSRG§SRG-OS-000471-VMM-001910

Description

-a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/newgrp -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/newgrp
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newgrp -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newgrp -F
          auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newgrp -F
          auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010164
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgrp
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap

Rule ID audit_rules_privileged_commands_newuidmap

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F path=/usr/bin/newuidmap -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/newuidmap -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/newuidmap -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/newuidmap
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newuidmap -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newuidmap -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newuidmap
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newuidmap -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newuidmap -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newuidmap
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newuidmap
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - postdrop

Rule ID audit_rules_privileged_commands_postdrop

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/postdrop -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/sbin/postdrop
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/postdrop -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/postdrop
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/postdrop
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_postdrop
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - postqueue

Rule ID audit_rules_privileged_commands_postqueue

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/postqueue -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/sbin/postqueue
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/postqueue -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/postqueue
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/postqueue -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/postqueue
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_postqueue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - rmmod

Rule ID audit_rules_privileged_commands_rmmod

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.16, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215

Description

-w /sbin/rmmod -p x -k modules

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/sbin/rmmod" "x" "modules"
fix_audit_watch_rule "augenrules" "/sbin/rmmod" "x" "modules"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Check if watch rule for /sbin/rmmod already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/sbin/rmmod\s+-p\s+x(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - audit_rules_privileged_commands_rmmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key modules
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)modules$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - audit_rules_privileged_commands_rmmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/modules.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/modules.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - audit_rules_privileged_commands_rmmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - audit_rules_privileged_commands_rmmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /sbin/rmmod in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /sbin/rmmod -p x -k modules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - audit_rules_privileged_commands_rmmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /sbin/rmmod already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/sbin/rmmod\s+-p\s+x(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - audit_rules_privileged_commands_rmmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /sbin/rmmod in /etc/audit/audit.rules
  lineinfile:
    line: -w /sbin/rmmod -p x -k modules
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - audit_rules_privileged_commands_rmmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Record Any Attempts to Run ssh-agent

Rule ID audit_rules_privileged_commands_ssh_agent

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.11, DISA§CCI-000130, DISA§CCI-000169, DISA§CCI-000172, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, STIGID§UBTU-20-010140

Description

At a minimum, the audit system should collect any execution attempt of the ssh-agent command for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d:

-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh-agent

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file:

-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh-agent

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/ssh-agent -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/ssh-agent
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/ssh-agent -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/ssh-agent -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/ssh-agent
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/ssh-agent -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/ssh-agent -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/ssh-agent
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010140
    - audit_rules_privileged_commands_ssh_agent
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign

Rule ID audit_rules_privileged_commands_ssh_keysign

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F path=/usr/lib/openssh/ssh-keysign -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/lib/openssh/ssh-keysign -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/lib/openssh/ssh-keysign -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/lib/openssh/ssh-keysign
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/lib/openssh/ssh-keysign -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/lib/openssh/ssh-keysign
          -F auid>=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/lib/openssh/ssh-keysign
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/lib/openssh/ssh-keysign -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/lib/openssh/ssh-keysign -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/lib/openssh/ssh-keysign
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010141
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_ssh_keysign
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - su

Rule ID audit_rules_privileged_commands_su

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.11, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§BAI03.05, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000135, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§AC-6(9), NIST§CM-6(a), NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.PT-1, OSPP§FAU_GEN.1.1.c, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, SRG§SRG-OS-000466-GPOS-00210, STIGID§UBTU-20-010136, VMMSRG§SRG-OS-000471-VMM-001910

Description

-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/su -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/su
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/su -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/su -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/su -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/su -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/su -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/su -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010136
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_su
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - sudo

Rule ID audit_rules_privileged_commands_sudo

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: ANSSI§BP28(R19), CIS§4.1.11, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§BAI03.05, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000135, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§AC-6(9), NIST§CM-6(a), NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.PT-1, OSPP§FAU_GEN.1.1.c, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, SRG§SRG-OS-000466-GPOS-00210, STIGID§UBTU-20-010161, VMMSRG§SRG-OS-000471-VMM-001910

Description

-a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/sudo -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/sudo
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/sudo -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudo -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudo -F auid>=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010161
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudo
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit

Rule ID audit_rules_privileged_commands_sudoedit

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.11, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§BAI03.05, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000135, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§AC-6(9), NIST§CM-6(a), NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.PT-1, OSPP§FAU_GEN.1.1.c, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000064-GPOS-00033, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, STIGID§UBTU-20-010162, VMMSRG§SRG-OS-000471-VMM-001910

Description

-a always,exit -F path=/usr/bin/sudoedit -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/sudoedit -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/sudoedit -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/sudoedit
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/sudoedit -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/sudoedit -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudoedit -F
          auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/sudoedit -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/sudoedit -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudoedit -F
          auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010162
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudoedit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - umount

Rule ID audit_rules_privileged_commands_umount

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.11, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§BAI03.05, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000135, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§AC-6(9), NIST§CM-6(a), NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.PT-1, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000471-GPOS-00215, STIGID§UBTU-20-010139, VMMSRG§SRG-OS-000471-VMM-001910

Description

-a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/bin/umount -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/bin/umount
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/umount -F auid>=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/umount -F
          auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/umount -F
          auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010139
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd

Rule ID audit_rules_privileged_commands_unix_chkpwd

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.11, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§BAI03.05, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000130, DISA§CCI-000135, DISA§CCI-000169, DISA§CCI-000172, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, NERC-CIP§CIP-004-3 R2.2.2, NERC-CIP§CIP-004-3 R2.2.3, NERC-CIP§CIP-007-3 R.1.3, NERC-CIP§CIP-007-3 R5, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.3, NERC-CIP§CIP-007-3 R5.2.1, NERC-CIP§CIP-007-3 R5.2.3, NERC-CIP§CIP-007-3 R6.5, NIST§AC-2(4), NIST§AU-2(d), NIST§AU-3, NIST§AU-3.1, NIST§AU-12(a), NIST§AU-12(c), NIST§AU-12.1(ii), NIST§AU-12.1(iv), NIST§AC-6(9), NIST§CM-6(a), NIST§MA-4(1)(a), NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.PT-1, OSPP§FAU_GEN.1.1.c, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215, VMMSRG§SRG-OS-000471-VMM-001910

Description

-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules:

-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset -F key=privileged

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



ACTION_ARCH_FILTERS="-a always,exit"
OTHER_FILTERS="-F path=/usr/sbin/unix_chkpwd -F perm=x"
AUID_FILTERS="-F auid>=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for /usr/sbin/unix_chkpwd
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/unix_chkpwd -F
          auid>=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/unix_chkpwd
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|")
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/unix_chkpwd
          -F auid>=1000 -F auid!=unset -F key=privileged
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_unix_chkpwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Record attempts to alter time through adjtimex

Rule ID audit_rules_time_adjtimex

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.3, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.4.1.1, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI08.02, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-001487, DISA§CCI-000169, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§AC-6(9), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.AC-3, NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, PCIDSS§Req-10.4.2.b

Description

If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:

-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules

The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined syscalls:

-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules

Rationale

Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}


# Function to perform remediation for the 'adjtimex', 'settimeofday', and 'stime' audit
# system calls on RHEL, Fedora or OL systems.
# Remediation performed for both possible tools: 'auditctl' and 'augenrules'.
#
# Note: 'stime' system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
# therefore excluded from the list of time group system calls to be audited on this arch
#
# Example Call:
#
#      perform_audit_adjtimex_settimeofday_stime_remediation
#
function perform_audit_adjtimex_settimeofday_stime_remediation {

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do

	# Create expected audit group and audit rule form for particular system call & architecture
	if [ ${ARCH} = "b32" ]
	then
		ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
		# stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
		# so append it to the list of time group system calls to be audited
		SYSCALL="adjtimex settimeofday stime"
		SYSCALL_GROUPING="adjtimex settimeofday stime"
	elif [ ${ARCH} = "b64" ]
	then
		ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
		# stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
		# therefore don't add it to the list of time group system calls to be audited
		SYSCALL="adjtimex settimeofday"
		SYSCALL_GROUPING="adjtimex settimeofday"
	fi
	OTHER_FILTERS=""
	AUID_FILTERS=""
	KEY="audit_time_rules"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

}
perform_audit_adjtimex_settimeofday_stime_remediation

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for adjtimex for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - adjtimex
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of adjtimex in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - adjtimex
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of adjtimex in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for adjtimex for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - adjtimex
        syscall_grouping:
          - adjtimex
          - settimeofday

    - name: Check existence of adjtimex in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - adjtimex
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of adjtimex in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Record Attempts to Alter Time Through clock_settime

Rule ID audit_rules_time_clock_settime

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change

-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a0=0x0"
	AUID_FILTERS=""
	SYSCALL="clock_settime"
	KEY="time-change"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for clock_settime for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - clock_settime
        syscall_grouping: []

    - name: Check existence of clock_settime in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/time-change.rules
      set_fact: audit_file="/etc/audit/rules.d/time-change.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a0=0x0 -F
          key=time-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - clock_settime
        syscall_grouping: []

    - name: Check existence of clock_settime in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a0=0x0 -F
          key=time-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for clock_settime for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - clock_settime
        syscall_grouping: []

    - name: Check existence of clock_settime in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/time-change.rules
      set_fact: audit_file="/etc/audit/rules.d/time-change.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a0=0x0 -F
          key=time-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - clock_settime
        syscall_grouping: []

    - name: Check existence of clock_settime in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a0=0x0 -F
          key=time-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Record attempts to alter time through settimeofday

Rule ID audit_rules_time_settimeofday

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules

If the system is 64 bit then also add the following line:

-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules

-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}


# Function to perform remediation for the 'adjtimex', 'settimeofday', and 'stime' audit
# system calls on RHEL, Fedora or OL systems.
# Remediation performed for both possible tools: 'auditctl' and 'augenrules'.
#
# Note: 'stime' system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
# therefore excluded from the list of time group system calls to be audited on this arch
#
# Example Call:
#
#      perform_audit_adjtimex_settimeofday_stime_remediation
#
function perform_audit_adjtimex_settimeofday_stime_remediation {

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do

	# Create expected audit group and audit rule form for particular system call & architecture
	if [ ${ARCH} = "b32" ]
	then
		ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
		# stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
		# so append it to the list of time group system calls to be audited
		SYSCALL="adjtimex settimeofday stime"
		SYSCALL_GROUPING="adjtimex settimeofday stime"
	elif [ ${ARCH} = "b64" ]
	then
		ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
		# stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
		# therefore don't add it to the list of time group system calls to be audited
		SYSCALL="adjtimex settimeofday"
		SYSCALL_GROUPING="adjtimex settimeofday"
	fi
	OTHER_FILTERS=""
	AUID_FILTERS=""
	KEY="audit_time_rules"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

}
perform_audit_adjtimex_settimeofday_stime_remediation

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for settimeofday for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - settimeofday
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of settimeofday in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - settimeofday
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of settimeofday in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for settimeofday for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - settimeofday
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of settimeofday in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - settimeofday
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of settimeofday in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Record Attempts to Alter Time Through stime

Rule ID audit_rules_time_stime

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-a always,exit -F arch=b32 -S stime -F key=audit_time_rules

Since the 64 bit version of the "stime" system call is not defined in the audit lookup table, the corresponding "-F arch=b64" form of this rule is not expected to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule form itself is sufficient for both 32 bit and 64 bit systems). If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file for both 32 bit and 64 bit systems:

-a always,exit -F arch=b32 -S stime -F key=audit_time_rules

Since the 64 bit version of the "stime" system call is not defined in the audit lookup table, the corresponding "-F arch=b64" form of this rule is not expected to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule form itself is sufficient for both 32 bit and 64 bit systems). The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport. Multiple system calls can be defined on the same line to save space if desired, but is not required. See an example of multiple combined system calls:

-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}


# Function to perform remediation for the 'adjtimex', 'settimeofday', and 'stime' audit
# system calls on RHEL, Fedora or OL systems.
# Remediation performed for both possible tools: 'auditctl' and 'augenrules'.
#
# Note: 'stime' system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
# therefore excluded from the list of time group system calls to be audited on this arch
#
# Example Call:
#
#      perform_audit_adjtimex_settimeofday_stime_remediation
#
function perform_audit_adjtimex_settimeofday_stime_remediation {

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do

	# Create expected audit group and audit rule form for particular system call & architecture
	if [ ${ARCH} = "b32" ]
	then
		ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
		# stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
		# so append it to the list of time group system calls to be audited
		SYSCALL="adjtimex settimeofday stime"
		SYSCALL_GROUPING="adjtimex settimeofday stime"
	elif [ ${ARCH} = "b64" ]
	then
		ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
		# stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
		# therefore don't add it to the list of time group system calls to be audited
		SYSCALL="adjtimex settimeofday"
		SYSCALL_GROUPING="adjtimex settimeofday"
	fi
	OTHER_FILTERS=""
	AUID_FILTERS=""
	KEY="audit_time_rules"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

}
perform_audit_adjtimex_settimeofday_stime_remediation

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Perform remediation of Audit rules for stime syscall for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - stime
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of stime in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - stime
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of stime in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_stime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Record Attempts to Alter the localtime File

Rule ID audit_rules_time_watch_localtime

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

-w /etc/localtime -p wa -k audit_time_rules

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-w /etc/localtime -p wa -k audit_time_rules

The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport and should always be used.

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
fix_audit_watch_rule "augenrules" "/etc/localtime" "wa" "audit_time_rules"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Check if watch rule for /etc/localtime already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/localtime\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_time_rules
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_time_rules$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_time_rules.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_time_rules.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/localtime in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/localtime -p wa -k audit_time_rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/localtime already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/localtime\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/localtime in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/localtime -p wa -k audit_time_rules
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Make the auditd Configuration Immutable

Rule ID audit_rules_immutable

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.17, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§19, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CJIS§5.4.1.1, COBIT5§APO01.06, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§BAI03.05, COBIT5§BAI08.02, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.3.1, CUI§3.4.3, DISA§CCI-000162, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.310(a)(2)(iv), HIPAA§164.312(d), HIPAA§164.310(d)(2)(iii), HIPAA§164.312(b), HIPAA§164.312(e), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 6.1, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§AC-6(9), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§ID.SC-4, NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, NIST-CSF§PR.PT-1, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, PCIDSS§Req-10.5.2, SRG§SRG-OS-000057-GPOS-00027, SRG§SRG-OS-000058-GPOS-00028, SRG§SRG-OS-000059-GPOS-00029

Description

-e 2

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file in order to make the auditd configuration immutable:

-e 2

With this setting, a reboot will be required to change any audit rules.

Rationale

Making the audit configuration immutable prevents accidental as well as malicious modification of the audit rules, although it may be problematic if legitimate changes are needed during system operation

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

# Traverse all of:
#
# /etc/audit/audit.rules,			(for auditctl case)
# /etc/audit/rules.d/*.rules			(for augenrules case)
#
# files to check if '-e .*' setting is present in that '*.rules' file already.
# If found, delete such occurrence since auditctl(8) manual page instructs the
# '-e 2' rule should be placed as the last rule in the configuration
find /etc/audit /etc/audit/rules.d -maxdepth 1 -type f -name '*.rules' -exec sed -i '/-e[[:space:]]\+.*/d' {} ';'

# Append '-e 2' requirement at the end of both:
# * /etc/audit/audit.rules file 		(for auditctl case)
# * /etc/audit/rules.d/immutable.rules		(for augenrules case)

for AUDIT_FILE in "/etc/audit/audit.rules" "/etc/audit/rules.d/immutable.rules"
do
	echo '' >> $AUDIT_FILE
	echo '# Set the audit.rules configuration immutable per security requirements' >> $AUDIT_FILE
	echo '# Reboot is required to change audit rules once this setting is applied' >> $AUDIT_FILE
	echo '-e 2' >> $AUDIT_FILE
	chmod o-rwx $AUDIT_FILE
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Collect all files from /etc/audit/rules.d with .rules extension
  find:
    paths: /etc/audit/rules.d/
    patterns: '*.rules'
  register: find_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Remove the -e option from all Audit config files
  lineinfile:
    path: '{{ item }}'
    regexp: ^\s*(?:-e)\s+.*$
    state: absent
  loop: '{{ find_rules_d.files | map(attribute=''path'') | list + [''/etc/audit/audit.rules'']
    }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add Audit -e option into /etc/audit/rules.d/immutable.rules and /etc/audit/audit.rules
  lineinfile:
    path: '{{ item }}'
    create: true
    line: -e 2
    mode: o-rwx
  loop:
    - /etc/audit/audit.rules
    - /etc/audit/rules.d/immutable.rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Mandatory Access Controls

Rule ID audit_rules_mac_modification

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.4.1.1, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI08.02, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.8, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.AC-3, NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, OSPP§FAU_GEN.1.1.c, PCIDSS§Req-10.5.5

Description

-w /etc/selinux/ -p wa -k MAC-policy

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-w /etc/selinux/ -p wa -k MAC-policy

Rationale

The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then




# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/etc/apparmor/" "wa" "MAC-policy"
fix_audit_watch_rule "auditctl" "/etc/apparmor.d/" "wa" "MAC-policy"
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "augenrules" "/etc/apparmor/" "wa" "MAC-policy"
fix_audit_watch_rule "augenrules" "/etc/apparmor.d/" "wa" "MAC-policy"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Check if watch rule for /etc/apparmor/ already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/apparmor/\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key MAC-policy
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)MAC-policy$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/MAC-policy.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/MAC-policy.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /etc/apparmor/ in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/apparmor/ -p wa -k MAC-policy
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /etc/apparmor.d/ already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/apparmor.d/\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key MAC-policy
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)MAC-policy$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/MAC-policy.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/MAC-policy.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /etc/apparmor.d/ in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/apparmor.d/ -p wa -k MAC-policy
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /etc/apparmor/ already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/apparmor/\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /etc/apparmor/ in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/apparmor/ -p wa -k MAC-policy
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /etc/apparmor.d/ already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/apparmor.d/\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /etc/apparmor.d/ in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/apparmor.d/ -p wa -k MAC-policy
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Ensure auditd Collects Information on Exporting to Media (successful)

Rule ID audit_rules_media_export

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.4.1.1, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI08.02, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, CUI§3.1.7, DISA§CCI-000135, DISA§CCI-000169, DISA§CCI-002884, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.312(a)(2)(i), HIPAA§164.312(b), HIPAA§164.312(d), HIPAA§164.312(e), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, NIST§AU-2(d), NIST§AU-12(c), NIST§AC-6(9), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.AC-3, NIST-CSF§PR.PT-1, NIST-CSF§PR.PT-4, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, PCIDSS§Req-10.2.7, SRG§SRG-OS-000037-GPOS-00015, SRG§SRG-OS-000042-GPOS-00020, SRG§SRG-OS-000062-GPOS-00031, SRG§SRG-OS-000392-GPOS-00172, SRG§SRG-OS-000462-GPOS-00206, SRG§SRG-OS-000471-GPOS-00215

Description

At a minimum, the audit system should collect media exportation events for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as appropriate for your system:

-a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export

-a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export

Rationale

The unauthorized exportation of data to external media could result in an information leak where classified information, Privacy Act information, and intellectual property could be lost. An audit trail should be created each time a filesystem is mounted to help identify and guard against information loss.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid>=1000 -F auid!=unset"
	SYSCALL="mount"
	KEY="perm_mod"
	SYSCALL_GROUPING=""

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit mount tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for mount for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for mount for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify the System's Network Environment

Rule ID audit_rules_networkconfig_modification

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as appropriate for your system:

-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file, setting ARCH to either b32 or b64 as appropriate for your system:

-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification

Rationale

The network environment should not be modified by anything other than administrator action. Any change to network parameters should be audited.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS=""
	SYSCALL="sethostname setdomainname"
	KEY="audit_rules_networkconfig_modification"
	SYSCALL_GROUPING="sethostname setdomainname"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

# Then perform the remediations for the watch rules
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/etc/issue" "wa" "audit_rules_networkconfig_modification"
fix_audit_watch_rule "augenrules" "/etc/issue" "wa" "audit_rules_networkconfig_modification"
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/etc/issue.net" "wa" "audit_rules_networkconfig_modification"
fix_audit_watch_rule "augenrules" "/etc/issue.net" "wa" "audit_rules_networkconfig_modification"
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/etc/hosts" "wa" "audit_rules_networkconfig_modification"
fix_audit_watch_rule "augenrules" "/etc/hosts" "wa" "audit_rules_networkconfig_modification"
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/etc/network" "wa" "audit_rules_networkconfig_modification"
fix_audit_watch_rule "augenrules" "/etc/network" "wa" "audit_rules_networkconfig_modification"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Remediate audit rules for network configuration for x86
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - sethostname
          - setdomainname
        syscall_grouping:
          - sethostname
          - setdomainname

    - name: Check existence of sethostname, setdomainname in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - sethostname
          - setdomainname
        syscall_grouping:
          - sethostname
          - setdomainname

    - name: Check existence of sethostname, setdomainname in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Remediate audit rules for network configuration for x86_64
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - sethostname
          - setdomainname
        syscall_grouping:
          - sethostname
          - setdomainname

    - name: Check existence of sethostname, setdomainname in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length >= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - sethostname
          - setdomainname
        syscall_grouping:
          - sethostname
          - setdomainname

    - name: Check existence of sethostname, setdomainname in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length > 0 and missing_syscalls | length > 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue.net already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/issue.net\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue.net in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue.net already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/issue.net\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue.net in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/hosts already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/hosts\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/hosts in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/hosts already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/hosts\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/hosts in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/network already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/network\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/network in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/network -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/network already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/network\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/network in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/network -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Record Attempts to Alter Process and Session Initiation Information

Rule ID audit_rules_session_events

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

The audit system already collects process information for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d in order to watch for attempted manual edits of files involved in storing such process information:

-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file in order to watch for attempted manual edits of files involved in storing such process information:

-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session

Rationale

Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/var/run/utmp" "wa" "session"
fix_audit_watch_rule "augenrules" "/var/run/utmp" "wa" "session"
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/var/log/btmp" "wa" "session"
fix_audit_watch_rule "augenrules" "/var/log/btmp" "wa" "session"
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/var/log/wtmp" "wa" "session"
fix_audit_watch_rule "augenrules" "/var/log/wtmp" "wa" "session"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Check if watch rule for /var/run/utmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/run/utmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/session.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/run/utmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/run/utmp -p wa -k session
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/run/utmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/run/utmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/run/utmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/run/utmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/btmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/btmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/session.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/btmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/btmp -p wa -k session
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/btmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/btmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/btmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/btmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/wtmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/wtmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/session.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/wtmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/wtmp -p wa -k session
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/wtmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/wtmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/wtmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/wtmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events When Privileged Executables Are Run

Rule ID audit_rules_suid_privilege_function

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.15, DISA§CCI-001814, DISA§CCI-001882, DISA§CCI-001889, DISA§CCI-001880, DISA§CCI-001881, DISA§CCI-001878, DISA§CCI-001879, DISA§CCI-001875, DISA§CCI-001877, DISA§CCI-001914, DISA§CCI-002234, NIST§CM-5(1), NIST§AU-7(a), NIST§AU-7(b), NIST§AU-8(b), NIST§AU-12(3), NIST§AC-6(9), SRG§SRG-OS-000326-GPOS-00126, SRG§SRG-OS-000327-GPOS-00127, SRG§SRG-OS-000337-GPOS-00129, SRG§SRG-OS-000348-GPOS-00136, SRG§SRG-OS-000349-GPOS-00137, SRG§SRG-OS-000350-GPOS-00138, SRG§SRG-OS-000351-GPOS-00139, SRG§SRG-OS-000352-GPOS-00140, SRG§SRG-OS-000353-GPOS-00141, SRG§SRG-OS-000354-GPOS-00142, SRG§SRG-OS-000358-GPOS-00145, SRG§SRG-OS-000359-GPOS-00146, SRG§SRG-OS-000365-GPOS-00152, STIGID§UBTU-20-010211

Description

Verify the system generates an audit record when privileged functions are executed.

# grep -iw execve /etc/audit/audit.rules

-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid

-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid

-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid

-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid

If both the "b32" and "b64" audit rules for "SUID" files are not defined, this is a finding. If both the "b32" and "b64" audit rules for "SGID" files are not defined, this is a finding.

Rationale

Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.

Warnings

warning Note that these rules can be configured in a number of ways while still achieving the desired effect.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-C uid!=euid -F euid=0"
	AUID_FILTERS=""
	SYSCALL="execve"
	KEY="setuid"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-C gid!=egid -F egid=0"
	AUID_FILTERS=""
	SYSCALL="execve"
	KEY="setgid"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# based on example audit syscall rule definitions as outlined in
# /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit
# package. It will combine multiple system calls belonging to the same
# syscall group into one audit rule (rather than to create audit rule per
# different system call) to avoid audit infrastructure performance penalty
# in the case of 'one-audit-rule-definition-per-one-system-call'. See:
#
#   https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html
#
# for further details.
#
# Expects seven arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules
# * action_arch_filters		The action and arch filters of the rule
#					For example, "-a always,exit -F arch=b64"
# * other_filters			Other filters that may characterize the rule:
#					For example, "-F a2&03 -F path=/etc/passwd"
# * auid_filters			The auid filters of the rule
#					For example, "-F auid>=1000 -F auid!=unset"
# * syscall					The syscall to ensure presense among audit rules
#					For example, "chown"
# * syscall_groupings		Other syscalls that can be grouped with 'syscall'
#					as a space separated list.
#					For example, "fchown lchown fchownat"
# * key						The key to use when appending a new rule
#
# Notes:
# - The 2-nd up to 4-th arguments are used to determine how many existing
# audit rules will be inspected for resemblance with the new audit rule
# the function is going to add.
# - The function's similarity check uses the 5-th argument to optimize audit
# rules definitions (merge syscalls of the same group into one rule) to avoid
# the "single-syscall-per-audit-rule" performance penalty.
# - The key argument (7-th argument) is not used when the syscall is grouped to an
# existing audit rule. The audit rule will retain the key it already had.

function fix_audit_syscall_rule {

# Load function arguments into local variables
local tool="$1"
local action_arch_filters="$2"
local other_filters="$3"
local auid_filters="$4"
local syscall_a
read -a syscall_a <<< "$5"
local syscall_grouping
read -a syscall_grouping <<< "$6"
local key="$7"

# Check sanity of the input
if [ $# -ne "7" ]
then
	echo "Usage: fix_audit_syscall_rule 'tool' 'action_arch_filters' 'other_filters' 'auid_filters' 'syscall' 'syscall_grouping' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
declare -a files_to_inspect

retval=0

# First check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	return 1
# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	default_file="/etc/audit/audit.rules"
	files_to_inspect+=('/etc/audit/audit.rules' )
# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
elif [ "$tool" == 'augenrules' ]
then
	default_file="/etc/audit/rules.d/${key}.rules"
	# As other_filters may include paths, lets use a different delimiter for it
	# The "F" script expression tells sed to print the filenames where the expressions matched
	readarray -t files_to_inspect < <(sed -s -n -e "/${action_arch_filters}/!d" -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" -e "F" /etc/audit/rules.d/*.rules)
	if [ $? -ne 0 ]
	then
		retval=1
	fi
	# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
	if [ ${#files_to_inspect[@]} -eq "0" ]
	then
		file_to_inspect="/etc/audit/rules.d/$key.rules"
		files_to_inspect=("$file_to_inspect")
		if [ ! -e "$file_to_inspect" ]
		then
			touch "$file_to_inspect"
			chmod 0640 "$file_to_inspect"
		fi
	fi
fi

#
# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
local append_expected_rule=0

for audit_file in "${files_to_inspect[@]}"
do
	# Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
	# i.e, collect rules that match:
	# * the action, list and arch, (2-nd argument)
	# * the other filters, (3-rd argument)
	# * the auid filters, (4-rd argument)
	readarray -t similar_rules < <(sed -e "/${action_arch_filters}/!d"  -e "\#${other_filters}#!d" -e "/${auid_filters}/!d" "$audit_file")
	if [ $? -ne 0 ]
	then
		retval=1
	fi

	local candidate_rules=()
	# Filter out rules that have more fields then required. This will remove rules more specific than the required scope
	for s_rule in "${similar_rules[@]}"
	do
		# Strip all the options and fields we know of,
		# than check if there was any field left over
		extra_fields=$(sed -E -e "s/${action_arch_filters}//"  -e "s#${other_filters}##" -e "s/${auid_filters}//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
		grep -q -- "-F" <<< "$extra_fields"
		if [ $? -ne 0 ]
		then
			candidate_rules+=("$s_rule")
		fi
	done

	if [[ ${#syscall_a[@]} -ge 1 ]]
	then
		# Check if the syscall we want is present in any of the similar existing rules
		for rule in "${candidate_rules[@]}"
		do
			rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
			local all_syscalls_found=0
			for syscall in "${syscall_a[@]}"
			do
				grep -q -- "\b${syscall}\b" <<< "$rule_syscalls"
				if [ $? -eq 1 ]
				then
					# A syscall was not found in the candidate rule
					all_syscalls_found=1
				fi
			done
			if [[ $all_syscalls_found -eq 0 ]]
			then
				# We found a rule with all the syscall(s) we want
				return $retval
			fi

			# Check if this rule can be grouped with our target syscall and keep track of it
			for syscall_g in "${syscall_grouping[@]}"
			do
				if grep -q -- "\b${syscall_g}\b" <<< "$rule_syscalls"
				then
					local file_to_edit=${audit_file}
					local rule_to_edit=${rule}
					local rule_syscalls_to_edit=${rule_syscalls}
				fi
			done
		done
	else
		# If there is any candidate rule, it is compliant.
		if [[ $candidate_rules ]]
		then
			return $retval
		fi
	fi
done


# We checked all rules that matched the expected resemblance patter (action, arch & auid)
# At this point we know if we need to either append the $full_rule or group
# the syscall together with an exsiting rule

# Append the full_rule if it cannot be grouped to any other rule
if [ -z ${rule_to_edit+x} ]
then
	# Build full_rule while avoid adding double spaces when other_filters is empty
	if [[ ${syscall_a} ]]
	then
		local syscall_string=""
		for syscall in "${syscall_a[@]}"
		do
			syscall_string+=" -S $syscall"
		done
	fi
	local other_string=$([[ $other_filters ]] && echo " $other_filters")
	local auid_string=$([[ $auid_filters ]] && echo " $auid_filters")
	local full_rule="${action_arch_filters}${syscall_string}${other_string}${auid_string} -F key=${key}"
	echo "$full_rule" >> "$default_file"
	chmod o-rwx ${default_file}
else
	# Check if the syscalls are declared as a comma separated list or
	# as multiple -S parameters
	if grep -q -- "," <<< "${rule_syscalls_to_edit}"
	then
		delimiter=","
	else
		delimiter=" -S "
	fi
	new_grouped_syscalls="${rule_syscalls_to_edit}"
	for syscall in "${syscall_a[@]}"
	do
		grep -q -- "\b${syscall}\b" <<< "${rule_syscalls_to_edit}"
		if [ $? -eq 1 ]
		then
			# A syscall was not found in the candidate rule
			new_grouped_syscalls+="${delimiter}${syscall}"
		fi
	done

	# Group the syscall in the rule
	sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
	if [ $? -ne 0 ]
	then
		retval=1
	fi
fi

return $retval

}
	fix_audit_syscall_rule "augenrules" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
	fix_audit_syscall_rule "auditctl" "$ACTION_ARCH_FILTERS" "$OTHER_FILTERS" "$AUID_FILTERS" "$SYSCALL" "$SYSCALL_GROUPING" "$KEY"
done

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Service facts
  service_facts: null
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010211
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(3)
    - NIST-800-53-AU-7(a)
    - NIST-800-53-AU-7(b)
    - NIST-800-53-AU-8(b)
    - NIST-800-53-CM-5(1)
    - audit_rules_suid_privilege_function
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check the rules script being used
  command: grep '^ExecStartPost' /usr/lib/systemd/system/auditd.service
  register: check_rules_scripts_result
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010211
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(3)
    - NIST-800-53-AU-7(a)
    - NIST-800-53-AU-7(b)
    - NIST-800-53-AU-8(b)
    - NIST-800-53-CM-5(1)
    - audit_rules_suid_privilege_function
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set suid_audit_rules fact
  set_fact:
    suid_audit_rules:
      - -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid
      - -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid
      - -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid
      - -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010211
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(3)
    - NIST-800-53-AU-7(a)
    - NIST-800-53-AU-7(b)
    - NIST-800-53-AU-8(b)
    - NIST-800-53-CM-5(1)
    - audit_rules_suid_privilege_function
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Update /etc/audit/rules.d/privileged.rules to audit privileged functions
  lineinfile:
    path: /etc/audit/rules.d/privileged.rules
    line: '{{  item  }}'
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"auditd.service" in ansible_facts.services'
    - '"augenrules" in check_rules_scripts_result.stdout'
  register: augenrules_audit_rules_privilege_function_update_result
  with_items: '{{ suid_audit_rules }}'
  tags:
    - DISA-STIG-UBTU-20-010211
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(3)
    - NIST-800-53-AU-7(a)
    - NIST-800-53-AU-7(b)
    - NIST-800-53-AU-8(b)
    - NIST-800-53-CM-5(1)
    - audit_rules_suid_privilege_function
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Update Update /etc/audit/audit.rules to audit privileged functions
  lineinfile:
    path: /etc/audit/audit.rules
    line: '{{  item  }}'
    create: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"auditd.service" in ansible_facts.services'
    - '"auditctl" in check_rules_scripts_result.stdout'
  register: auditctl_audit_rules_privilege_function_update_result
  with_items: '{{ suid_audit_rules }}'
  tags:
    - DISA-STIG-UBTU-20-010211
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(3)
    - NIST-800-53-AU-7(a)
    - NIST-800-53-AU-7(b)
    - NIST-800-53-AU-8(b)
    - NIST-800-53-CM-5(1)
    - audit_rules_suid_privilege_function
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Reload Auditd
  command: /usr/sbin/service auditd reload
  args:
    warn: false
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (augenrules_audit_rules_privilege_function_update_result.changed or auditctl_audit_rules_privilege_function_update_result.changed)
    - ansible_facts.services["auditd.service"].state == "running"
  tags:
    - DISA-STIG-UBTU-20-010211
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(3)
    - NIST-800-53-AU-7(a)
    - NIST-800-53-AU-7(b)
    - NIST-800-53-AU-8(b)
    - NIST-800-53-CM-5(1)
    - audit_rules_suid_privilege_function
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure auditd Collects System Administrator Actions

Rule ID audit_rules_sysadmin_actions

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

At a minimum, the audit system should collect administrator actions for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following line to a file with suffix .rules in the directory /etc/audit/rules.d:

-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file:

-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions

Rationale

The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/etc/sudoers" "wa" "actions"
fix_audit_watch_rule "augenrules" "/etc/sudoers" "wa" "actions"
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/etc/sudoers.d/" "wa" "actions"
fix_audit_watch_rule "augenrules" "/etc/sudoers.d/" "wa" "actions"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Search /etc/audit/rules.d for audit rule entries for sysadmin actions
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*/etc/sudoers.*$
    patterns: '*.rules'
  register: find_audit_sysadmin_actions
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/actions.rules as the recipient for the rule
  set_fact:
    all_sysadmin_actions_files:
      - /etc/audit/rules.d/actions.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_audit_sysadmin_actions.matched is defined and find_audit_sysadmin_actions.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_sysadmin_actions_files:
      - '{{ find_audit_sysadmin_actions.files | map(attribute=''path'') | list | first
        }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_audit_sysadmin_actions.matched is defined and find_audit_sysadmin_actions.matched
      > 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers rule in rules.d
  lineinfile:
    path: '{{ all_sysadmin_actions_files[0] }}'
    line: -w /etc/sudoers -p wa -k actions
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers.d rule in rules.d
  lineinfile:
    path: '{{ all_sysadmin_actions_files[0] }}'
    line: -w /etc/sudoers.d/ -p wa -k actions
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -w /etc/sudoers -p wa -k actions
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers.d in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -w /etc/sudoers.d/ -p wa -k actions
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Record Events that Modify User/Group Information - /etc/group

Rule ID audit_rules_usergroup_modification_group

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d, in order to capture events that modify account changes:

-w /etc/group -p wa -k audit_rules_usergroup_modification

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file, in order to capture events that modify account changes:

-w /etc/group -p wa -k audit_rules_usergroup_modification

Rationale

In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/etc/group" "wa" "audit_rules_usergroup_modification"
fix_audit_watch_rule "augenrules" "/etc/group" "wa" "audit_rules_usergroup_modification"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit group tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010101
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_group
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010101
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_group.matched is defined and find_group.matched == 0
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010101
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_group.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_group.matched is defined and find_group.matched > 0
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010101
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the group rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/group -p wa -k audit_rules_usergroup_modification
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010101
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the group rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/group -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010101
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify User/Group Information - /etc/gshadow

Rule ID audit_rules_usergroup_modification_gshadow

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d, in order to capture events that modify account changes:

-w /etc/gshadow -p wa -k audit_rules_usergroup_modification

-w /etc/gshadow -p wa -k audit_rules_usergroup_modification

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/etc/gshadow" "wa" "audit_rules_usergroup_modification"
fix_audit_watch_rule "augenrules" "/etc/gshadow" "wa" "audit_rules_usergroup_modification"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit gshadow tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010103
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_gshadow
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010103
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_gshadow.matched is defined and find_gshadow.matched == 0
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010103
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_gshadow.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_gshadow.matched is defined and find_gshadow.matched > 0
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010103
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the gshadow rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010103
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the gshadow rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010103
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify User/Group Information - /etc/security/opasswd

Rule ID audit_rules_usergroup_modification_opasswd

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d, in order to capture events that modify account changes:

-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification

-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/etc/security/opasswd" "wa" "audit_rules_usergroup_modification"
fix_audit_watch_rule "augenrules" "/etc/security/opasswd" "wa" "audit_rules_usergroup_modification"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit opasswd tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010104
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_opasswd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010104
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_opasswd.matched is defined and find_opasswd.matched == 0
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010104
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_opasswd.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_opasswd.matched is defined and find_opasswd.matched > 0
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010104
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the opasswd rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010104
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the opasswd rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010104
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify User/Group Information - /etc/passwd

Rule ID audit_rules_usergroup_modification_passwd

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d, in order to capture events that modify account changes:

-w /etc/passwd -p wa -k audit_rules_usergroup_modification

-w /etc/passwd -p wa -k audit_rules_usergroup_modification

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/etc/passwd" "wa" "audit_rules_usergroup_modification"
fix_audit_watch_rule "augenrules" "/etc/passwd" "wa" "audit_rules_usergroup_modification"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit passwd tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010100
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_passwd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010100
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_passwd.matched is defined and find_passwd.matched == 0
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010100
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_passwd.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_passwd.matched is defined and find_passwd.matched > 0
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010100
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the passwd rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010100
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the passwd rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010100
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Record Events that Modify User/Group Information - /etc/shadow

Rule ID audit_rules_usergroup_modification_shadow

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d, in order to capture events that modify account changes:

-w /etc/shadow -p wa -k audit_rules_usergroup_modification

-w /etc/shadow -p wa -k audit_rules_usergroup_modification

Rationale

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to fix audit file system object watch rule for given path:
# * if rule exists, also verifies the -w bits match the requirements
# * if rule doesn't exist yet, appends expected rule form to $files_to_inspect
#   audit rules file, depending on the tool which was used to load audit rules
#
# Expects four arguments (each of them is required) in the form of:
# * audit tool				tool used to load audit rules,
# 					either 'auditctl', or 'augenrules'
# * path                        	value of -w audit rule's argument
# * required access bits        	value of -p audit rule's argument
# * key                         	value of -k audit rule's argument
#
# Example call:
#
#       fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules"
#
function fix_audit_watch_rule {

# Load function arguments into local variables
local tool="$1"
local path="$2"
local required_access_bits="$3"
local key="$4"

# Check sanity of the input
if [ $# -ne "4" ]
then
	echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'"
	echo "Aborting."
	exit 1
fi

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
declare -a files_to_inspect
files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect+=('/etc/audit/audit.rules')
# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection.
elif [ "$tool" == 'augenrules' ]
then
	readarray -t matches < <(grep -P "[\s]*-w[\s]+$path" /etc/audit/rules.d/*.rules)

	# For each of the matched entries
	for match in "${matches[@]}"
	do
		# Extract filepath from the match
		rulesd_audit_file=$(echo $match | cut -f1 -d ':')
		# Append that path into list of files for inspection
		files_to_inspect+=("$rulesd_audit_file")
	done
	# Case when particular audit rule isn't defined yet
	if [ "${#files_to_inspect[@]}" -eq "0" ]
	then
		# Append '/etc/audit/rules.d/$key.rules' into list of files for inspection
		local key_rule_file="/etc/audit/rules.d/$key.rules"
		# If the $key.rules file doesn't exist yet, create it with correct permissions
		if [ ! -e "$key_rule_file" ]
		then
			touch "$key_rule_file"
			chmod 0640 "$key_rule_file"
		fi

		files_to_inspect+=("$key_rule_file")
	fi
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do

	# Check if audit watch file system object rule for given path already present
	if grep -q -P -- "[\s]*-w[\s]+$path" "$audit_rules_file"
	then
		# Rule is found => verify yet if existing rule definition contains
		# all of the required access type bits

		# Escape slashes in path for use in sed pattern below
		local esc_path=${path//$'/'/$'\/'}
		# Define BRE whitespace class shortcut
		local sp="[[:space:]]"
		# Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
		current_access_bits=$(sed -ne "s/$sp*-w$sp\+$esc_path$sp\+-p$sp\+\([rxwa]\{1,4\}\).*/\1/p" "$audit_rules_file")
		# Split required access bits string into characters array
		# (to check bit's presence for one bit at a time)
		for access_bit in $(echo "$required_access_bits" | grep -o .)
		do
			# For each from the required access bits (e.g. 'w', 'a') check
			# if they are already present in current access bits for rule.
			# If not, append that bit at the end
			if ! grep -q "$access_bit" <<< "$current_access_bits"
			then
				# Concatenate the existing mask with the missing bit
				current_access_bits="$current_access_bits$access_bit"
			fi
		done
		# Propagate the updated rule's access bits (original + the required
		# ones) back into the /etc/audit/audit.rules file for that rule
		sed -i "s/\($sp*-w$sp\+$esc_path$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)/\1$current_access_bits\3/" "$audit_rules_file"
	else
		# Rule isn't present yet. Append it at the end of $audit_rules_file file
		# with proper key

		echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file"
	fi
done
}
fix_audit_watch_rule "auditctl" "/etc/shadow" "wa" "audit_rules_usergroup_modification"
fix_audit_watch_rule "augenrules" "/etc/shadow" "wa" "audit_rules_usergroup_modification"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Set architecture for audit shadow tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010102
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_shadow
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010102
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_shadow.matched is defined and find_shadow.matched == 0
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010102
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_shadow.files | map(attribute=''path'') | list | first }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - find_shadow.matched is defined and find_shadow.matched > 0
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010102
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the shadow rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010102
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the shadow rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010102
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

Configure auditd mail_acct Action on Low Disk Space

Rule ID auditd_data_retention_action_mail_acct

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.2.3, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CJIS§5.4.1.1, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI04.04, COBIT5§BAI08.02, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§MEA02.01, CUI§3.3.1, DISA§CCI-000139, DISA§CCI-001855, HIPAA§164.312(a)(2)(ii), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.17.2.1, NERC-CIP§CIP-003-3 R1.3, NERC-CIP§CIP-003-3 R3, NERC-CIP§CIP-003-3 R3.1, NERC-CIP§CIP-003-3 R3.2, NERC-CIP§CIP-003-3 R3.3, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.2.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.2, NERC-CIP§CIP-007-3 R5.2, NERC-CIP§CIP-007-3 R5.3.1, NERC-CIP§CIP-007-3 R5.3.2, NERC-CIP§CIP-007-3 R5.3.3, NIST§IA-5(1), NIST§AU-5(a), NIST§AU-5(2), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§PR.DS-4, NIST-CSF§PR.PT-1, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, PCIDSS§Req-10.7.a, SRG§SRG-OS-000046-GPOS-00022, SRG§SRG-OS-000343-GPOS-00134, STIGID§UBTU-20-010117, VMMSRG§SRG-OS-000046-VMM-000210, VMMSRG§SRG-OS-000343-VMM-001240

Description

The auditd service can be configured to send email to a designated account in certain situations. Add or correct the following line in /etc/audit/auditd.conf to ensure that administrators are notified via email for those situations:

action_mail_acct = root

Rationale

Email sent to the root account is typically aliased to the administrators of the system, who can take appropriate action.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


var_auditd_action_mail_acct='root'



AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^action_mail_acct")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_action_mail_acct"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^action_mail_acct\\>" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^action_mail_acct\\>.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$AUDITCONFIG" >> "$AUDITCONFIG"
    printf '%s\n' "$formatted_output" >> "$AUDITCONFIG"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_auditd_action_mail_acct # promote to variable
  set_fact:
    var_auditd_action_mail_acct: !!str root
  tags:
    - always

- name: Configure auditd mail_acct Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: action_mail_acct = {{ var_auditd_action_mail_acct }}
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010117
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)
    - PCI-DSS-Req-10.7.a
    - auditd_data_retention_action_mail_acct
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Configure auditd admin_space_left Action on Low Disk Space

Rule ID auditd_data_retention_admin_space_left_action

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

The auditd service can be configured to take an action when disk space is running low but prior to running out of space completely. Edit the file /etc/audit/auditd.conf. Add or modify the following line, substituting ACTION appropriately:

admin_space_left_action = ACTION

Set this value to single to cause the system to switch to single user mode for corrective action. Acceptable values also include suspend and halt. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. Details regarding all possible values for ACTION are described in the auditd.conf man page.

Rationale

Administrators should be made aware of an inability to record audit records. If a separate partition or logical volume of adequate size is used, running low on space for audit records should never occur.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


var_auditd_admin_space_left_action='single'



AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^admin_space_left_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_admin_space_left_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^admin_space_left_action\\>" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^admin_space_left_action\\>.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$AUDITCONFIG" >> "$AUDITCONFIG"
    printf '%s\n' "$formatted_output" >> "$AUDITCONFIG"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_auditd_admin_space_left_action # promote to variable
  set_fact:
    var_auditd_admin_space_left_action: !!str single
  tags:
    - always

- name: Configure auditd admin_space_left Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: admin_space_left_action = {{ var_auditd_admin_space_left_action }}
    regexp: ^\s*admin_space_left_action\s*=\s*.*$
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_admin_space_left_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Configure auditd Max Log File Size

Rule ID auditd_data_retention_max_log_file

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

Determine the amount of audit data (in megabytes) which should be retained in each log file. Edit the file /etc/audit/auditd.conf. Add or modify the following line, substituting the correct value of 6 for STOREMB:

max_log_file = STOREMB

Set the value to 6 (MB) or higher for general-purpose systems. Larger values, of course, support retention of even more audit data.

Rationale

The total storage for audit log files must be large enough to retain log information over the period required. This is a function of the maximum log file size and the number of logs retained.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


var_auditd_max_log_file='6'



AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^max_log_file")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_max_log_file"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^max_log_file\\>" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^max_log_file\\>.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$AUDITCONFIG" >> "$AUDITCONFIG"
    printf '%s\n' "$formatted_output" >> "$AUDITCONFIG"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_auditd_max_log_file # promote to variable
  set_fact:
    var_auditd_max_log_file: !!str 6
  tags:
    - always

- name: Configure auditd Max Log File Size
  lineinfile:
    dest: /etc/audit/auditd.conf
    regexp: ^\s*max_log_file\s*=\s*.*$
    line: max_log_file = {{ var_auditd_max_log_file }}
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_max_log_file
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Configure auditd max_log_file_action Upon Reaching Maximum Log Size

Rule ID auditd_data_retention_max_log_file_action

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.2.2, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CJIS§5.4.1.1, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI04.04, COBIT5§BAI08.02, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§MEA02.01, DISA§CCI-000140, HIPAA§164.312(a)(2)(ii), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.17.2.1, NIST§AU-5(b), NIST§AU-5(2), NIST§AU-5(1), NIST§AU-5(4), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§PR.DS-4, NIST-CSF§PR.PT-1, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, PCIDSS§Req-10.7, SRG§SRG-OS-000047-GPOS-00023

Description

The default action to take when the logs reach their maximum size is to rotate the log files, discarding the oldest one. To configure the action taken by auditd, add or correct the line in /etc/audit/auditd.conf:

max_log_file_action = ACTION

Possible values for ACTION are described in the auditd.conf man page. These include:

syslog
suspend
rotate
keep_logs

Set the ACTION to rotate to ensure log rotation occurs. This is the default. The setting is case-insensitive.

Rationale

Automatically rotating logs (by setting this to rotate) minimizes the chances of the system unexpectedly running out of disk space by being overwhelmed with log data. However, for systems that must never discard log data, or which use external processes to transfer it and reclaim space, keep_logs can be employed.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


var_auditd_max_log_file_action='rotate'



AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^max_log_file_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_max_log_file_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^max_log_file_action\\>" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^max_log_file_action\\>.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$AUDITCONFIG" >> "$AUDITCONFIG"
    printf '%s\n' "$formatted_output" >> "$AUDITCONFIG"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_auditd_max_log_file_action # promote to variable
  set_fact:
    var_auditd_max_log_file_action: !!str rotate
  tags:
    - always

- name: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: max_log_file_action = {{ var_auditd_max_log_file_action }}
    regexp: ^\s*max_log_file_action\s*=\s*.*$
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_max_log_file_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Configure auditd space_left Action on Low Disk Space

Rule ID auditd_data_retention_space_left_action

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.2.3, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§19, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CJIS§5.4.1.1, COBIT5§APO11.04, COBIT5§APO12.06, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI04.04, COBIT5§BAI08.02, COBIT5§DSS02.02, COBIT5§DSS02.04, COBIT5§DSS02.07, COBIT5§DSS03.01, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§MEA02.01, CUI§3.3.1, DISA§CCI-001855, HIPAA§164.312(a)(2)(ii), ISA-62443-2009§4.2.3.10, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.3.4.5.6, ISA-62443-2009§4.3.4.5.7, ISA-62443-2009§4.3.4.5.8, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.16.1.4, ISO27001-2013§A.16.1.5, ISO27001-2013§A.16.1.7, ISO27001-2013§A.17.2.1, NIST§AU-5(b), NIST§AU-5(2), NIST§AU-5(1), NIST§AU-5(4), NIST§CM-6(a), NIST-CSF§DE.AE-3, NIST-CSF§DE.AE-5, NIST-CSF§PR.DS-4, NIST-CSF§PR.PT-1, NIST-CSF§RS.AN-1, NIST-CSF§RS.AN-4, PCIDSS§Req-10.7, SRG§SRG-OS-000343-GPOS-00134, STIGID§UBTU-20-010217, VMMSRG§SRG-OS-000343-VMM-001240

Description

The auditd service can be configured to take an action when disk space starts to run low. Edit the file /etc/audit/auditd.conf. Modify the following line, substituting ACTION appropriately:

space_left_action = ACTION

Possible values for ACTION are described in the auditd.conf man page. These include:

syslog
email
exec
suspend
single
halt

Set this to email (instead of the default, which is suspend) as it is more likely to get prompt attention. Acceptable values also include suspend, single, and halt.

Rationale

Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


var_auditd_space_left_action='email'



#
# If space_left_action present in /etc/audit/auditd.conf, change value
# to var_auditd_space_left_action, else
# add "space_left_action = $var_auditd_space_left_action" to /etc/audit/auditd.conf
#

AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^space_left_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_space_left_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^space_left_action\\>" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^space_left_action\\>.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$AUDITCONFIG" >> "$AUDITCONFIG"
    printf '%s\n' "$formatted_output" >> "$AUDITCONFIG"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_auditd_space_left_action # promote to variable
  set_fact:
    var_auditd_space_left_action: !!str email
  tags:
    - always

- name: Configure auditd space_left Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: space_left_action = {{ var_auditd_space_left_action }}
    regexp: ^\s*space_left_action\s*=\s*.*$
    state: present
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010217
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_space_left_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure the audit Subsystem is Installed

Rule ID package_audit_installed

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: ANSSI§BP28(R50), CIS§4.1.1.1, DISA§CCI-000172, DISA§CCI-001814, DISA§CCI-001875, DISA§CCI-001877, DISA§CCI-001878, DISA§CCI-001879, DISA§CCI-001880, DISA§CCI-001881, DISA§CCI-001882, DISA§CCI-001889, DISA§CCI-001914, DISA§CCI-000169, NERC-CIP§CIP-004-3 R3.3, NERC-CIP§CIP-007-3 R6.5, NIST§AC-7(a), NIST§AU-7(1), NIST§AU-7(2), NIST§AU-14, NIST§AU-12(2), NIST§AU-2(a), NIST§CM-6(a), SRG§SRG-OS-000122-GPOS-00063, SRG§SRG-OS-000337-GPOS-00129, SRG§SRG-OS-000348-GPOS-00136, SRG§SRG-OS-000349-GPOS-00137, SRG§SRG-OS-000350-GPOS-00138, SRG§SRG-OS-000351-GPOS-00139, SRG§SRG-OS-000352-GPOS-00140, SRG§SRG-OS-000353-GPOS-00141, SRG§SRG-OS-000354-GPOS-00142, SRG§SRG-OS-000358-GPOS-00145, SRG§SRG-OS-000359-GPOS-00146, SRG§SRG-OS-000365-GPOS-00152, SRG§SRG-OS-000474-GPOS-00219, SRG§SRG-OS-000475-GPOS-00220, SRG§SRG-OS-000480-GPOS-00227, SRG§SRG-OS-000062-GPOS-00031, STIGID§UBTU-20-010182

Description

The audit package should be installed.

Rationale

The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

DEBIAN_FRONTEND=noninteractive apt-get install -y "auditd"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Ensure auditd is installed
  package:
    name: auditd
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010182
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AU-12(2)
    - NIST-800-53-AU-14
    - NIST-800-53-AU-2(a)
    - NIST-800-53-AU-7(1)
    - NIST-800-53-AU-7(2)
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_audit_installed

Remediation Puppet snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

include install_auditd

class install_auditd {
  package { 'auditd':
    ensure => 'installed',
  }
}

Remediation script: (show)


[[packages]]
name = "auditd"
version = "*"

Enable auditd Service

Rule ID service_auditd_enabled

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

The auditd service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The auditd service can be enabled with the following command:

$ sudo systemctl enable auditd.service

Rationale

Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Ensuring the auditd service is active ensures audit records generated by the kernel are appropriately recorded.

Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'auditd.service'
"$SYSTEMCTL_EXEC" start 'auditd.service'
"$SYSTEMCTL_EXEC" enable 'auditd.service'

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Enable service auditd
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service auditd
      service:
        name: auditd
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"auditd" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010182
    - NIST-800-171-3.3.1
    - NIST-800-171-3.3.2
    - NIST-800-171-3.3.6
    - NIST-800-53-AC-2(g)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-14(1)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_auditd_enabled

Remediation Puppet snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

include enable_auditd

class enable_auditd {
  service {'auditd':
    enable => true,
    ensure => 'running',
  }
}

Enable Auditing for Processes Which Start Prior to the Audit Daemon

Rule ID grub2_audit_argument

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

Description

To ensure all processes can be audited, even those which start prior to the audit daemon, add the argument audit=1 to the default GRUB 2 command line for the Linux operating system in /etc/default/grub, so that the line looks similar to

GRUB_CMDLINE_LINUX="... audit=1 ..."

In case the GRUB_DISABLE_RECOVERY is set to true, then the parameter should be added to the GRUB_CMDLINE_LINUX_DEFAULT instead.

Rationale

Each process on the system carries an "auditable" flag which indicates whether its activities can be audited. Although auditd takes care of enabling this for all processes which launch after it does, adding the kernel argument ensures it is set for every process during boot.

Warnings

warning The GRUB 2 configuration file, grub.cfg, is automatically updated each time a new kernel is installed. Note that any changes to /etc/default/grub require rebuilding the grub.cfg file. To update the GRUB 2 configuration file manually, use the

grub2-mkconfig -o

command as follows:

On BIOS-based machines, issue the following command as root:
```
~]# grub2-mkconfig -o /boot/grub/grub.cfg
```
On UEFI-based machines, issue the following command as root:
```
~]# update-grub
```

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'grub2-common' 2>/dev/null | grep -q installed; }; then

# Correct the form of default kernel command line in GRUB
if grep -q '^GRUB_CMDLINE_LINUX=.*audit=.*"'  '/etc/default/grub' ; then
	# modify the GRUB command-line if an audit= arg already exists
	sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)audit=[^[:space:]]*\(.*"\)/\1 audit=1 \2/'  '/etc/default/grub'
else
	# no audit=arg is present, append it
	sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 audit=1"/'  '/etc/default/grub'
fi


update-grub

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	medium
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010198
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - grub2_audit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: check audit argument exists
  command: grep 'GRUB_CMDLINE_LINUX.*audit=' /etc/default/grub
  failed_when: false
  register: argcheck
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010198
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - grub2_audit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: replace existing audit argument
  replace:
    path: /etc/default/grub
    regexp: audit=\w+
    replace: audit=1
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
    - argcheck.rc == 0
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010198
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - grub2_audit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: add audit argument
  replace:
    path: /etc/default/grub
    regexp: (GRUB_CMDLINE_LINUX=.*)"
    replace: \1 audit=1"
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
    - argcheck.rc != 0
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010198
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - grub2_audit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: update bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="audit=1"
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - DISA-STIG-UBTU-20-010198
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - grub2_audit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

Extend Audit Backlog Limit for the Audit Daemon

Rule ID grub2_audit_backlog_limit_argument

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.1.1.4, DISA§CCI-001849, NIST§CM-6(a), SRG§SRG-OS-000254-GPOS-00095, SRG§SRG-OS-000341-GPOS-00132

Description

To improve the kernel capacity to queue all log events, even those which occurred prior to the audit daemon, add the argument audit_backlog_limit=8192 to the default GRUB 2 command line for the Linux operating system in /etc/default/grub, in the manner below:

GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=VolGroup/LogVol06 rd.lvm.lv=VolGroup/lv_swap rhgb quiet rd.shell=0 audit=1 audit_backlog_limit=8192"

Rationale

audit_backlog_limit sets the queue length for audit events awaiting transfer to the audit daemon. Until the audit daemon is up and running, all log messages are stored in this queue. If the queue is overrun during boot process, the action defined by audit failure flag is taken.

Warnings

grub2-mkconfig -o

command as follows:

On BIOS-based machines, issue the following command as root:
```
~]# grub2-mkconfig -o /boot/grub/grub.cfg
```
On UEFI-based machines, issue the following command as root:
```
~]# update-grub
```

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'grub2-common' 2>/dev/null | grep -q installed; }; then

# Correct the form of default kernel command line in GRUB
if grep -q '^GRUB_CMDLINE_LINUX=.*audit_backlog_limit=.*"'  '/etc/default/grub' ; then
	# modify the GRUB command-line if an audit_backlog_limit= arg already exists
	sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)audit_backlog_limit=[^[:space:]]*\(.*"\)/\1 audit_backlog_limit=8192 \2/'  '/etc/default/grub'
else
	# no audit_backlog_limit=arg is present, append it
	sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 audit_backlog_limit=8192"/'  '/etc/default/grub'
fi


update-grub

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	medium
Disruption:	low
Reboot:	true
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_audit_backlog_limit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: check audit_backlog_limit argument exists
  command: grep 'GRUB_CMDLINE_LINUX.*audit_backlog_limit=' /etc/default/grub
  failed_when: false
  register: argcheck
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_audit_backlog_limit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: replace existing audit_backlog_limit argument
  replace:
    path: /etc/default/grub
    regexp: audit_backlog_limit=\w+
    replace: audit_backlog_limit=8192
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
    - argcheck.rc == 0
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_audit_backlog_limit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: add audit_backlog_limit argument
  replace:
    path: /etc/default/grub
    regexp: (GRUB_CMDLINE_LINUX=.*)"
    replace: \1 audit_backlog_limit=8192"
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
    - argcheck.rc != 0
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_audit_backlog_limit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: update bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="audit_backlog_limit=8192"
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - grub2_audit_backlog_limit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

Ensure AppArmor is installed

Rule ID	package_apparmor_installed
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§1.7.1.1
Description	AppArmor provide Mandatory Access Controls.
Rationale	Without a Mandatory Access Control system installed only the default Discretionary Access Control system will be available.

Ensure all AppArmor Profiles are in enforce mode

Rule ID ensure_apparmor_enforce

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§1.7.1.4

Description

AppArmor profiles define what resources applications are able to access.

Rationale

Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.

Remediation Shell script: (show)

Disruption:	high
Reboot:	true

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



# apparmor and apparmor-utils must be installed to be compliant to this rule.
dpkg-query --show --showformat='${db:Status-Status}\n' "apparmor" 2>/dev/null | grep -q installed || DEBIAN_FRONTEND=noninteractive apt-get install apparmor -y
dpkg-query --show --showformat='${db:Status-Status}\n' "apparmor-utils" 2>/dev/null | grep -q installed || DEBIAN_FRONTEND=noninteractive apt-get install apparmor-utils -y

aa-enforce /etc/apparmor.d/*

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ensure all AppArmor Profiles are in enforce or complain mode

Rule ID	ensure_apparmor_enforce_or_complain
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§1.7.1.3
Description	AppArmor profiles define what resources applications are able to access.
Rationale	Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.

Ensure AppArmor is enabled in the bootloader configuration

Rule ID	grub2_enable_apparmor
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§1.7.1.2
Description	Configure AppArmor to be enabled at boot time and verify that it has not been overwritten by the bootloader boot parameters. Note: This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment, enact equivalent settings.
Rationale	AppArmor must be enabled at boot time in your bootloader configuration to ensure that the controls it provides are not overridden.
Remediation Shell script: (show) # Remediation is applicable only in certain platforms if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then # Helper to add a grub2 boot parameter. add_kernel_boot_param() { local param_to_add="$1" local param_to_add_val="$2" local grub_cfg=/etc/default/grub if [ -z "${param_to_add}" ]; then exec_error "No parameter added to ${FUNCNAME}" return fi local cur_param=$(grep -Po "(?<=^GRUB_CMDLINE_LINUX=\")[^\"]*" ${grub_cfg}) if [ $? -eq 0 ]; then # Remove old param, if it exist tmp_vec=($(echo "${cur_param}" \| sed -E "s/\b${param_to_add}\b(=\S+)?//")) # And add new param if [ -z "${param_to_add_val}" ]; then tmp_vec+=("${param_to_add}") else tmp_vec+=("${param_to_add}=${param_to_add_val}") fi cur_param="${tmp_vec[@]}" # Remove old GRUB_CMDLINE_LINUX entry sed -i /^GRUB_CMDLINE_LINUX=/d ${grub_cfg} fi echo "GRUB_CMDLINE_LINUX=\"${cur_param}\"" >> ${grub_cfg} } add_kernel_boot_param apparmor 1 add_kernel_boot_param security apparmor # Execute update grub and fix permissions changed do_update_grub() { local cfg="/boot/grub/grub.cfg" update-grub chown root:root $cfg chmod og-rwx $cfg } do_update_grub else >&2 echo 'Remediation is not applicable, nothing was done' fi

Verify /boot/grub/grub.cfg User Ownership

Rule ID	file_owner_grub2_cfg
Result	notapplicable
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§1.5.2, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CJIS§5.5.2.2, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, CUI§3.4.5, DISA§CCI-000225, HIPAA§164.308(a)(1)(ii)(B), HIPAA§164.308(a)(7)(i), HIPAA§164.308(a)(7)(ii)(A), HIPAA§164.310(a)(1), HIPAA§164.310(a)(2)(i), HIPAA§164.310(a)(2)(ii), HIPAA§164.310(a)(2)(iii), HIPAA§164.310(b), HIPAA§164.310(c), HIPAA§164.310(d)(1), HIPAA§164.310(d)(2)(iii), ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, PCIDSS§Req-7.1
Description	The file `/boot/grub/grub.cfg` should be owned by the `root` user to prevent destruction or modification of the file. To properly set the owner of `{{{ grub2_boot_path }}}/grub.cfg`, run the command: $ sudo chown root {{{ grub2_boot_path }}}/grub.cfg
Rationale	Only root should be able to modify important boot parameters.

Verify /boot/grub/grub.cfg Permissions

Rule ID	file_permissions_grub2_cfg
Result	notapplicable
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§1.5.2, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, CUI§3.4.5, DISA§CCI-000225, HIPAA§164.308(a)(1)(ii)(B), HIPAA§164.308(a)(7)(i), HIPAA§164.308(a)(7)(ii)(A), HIPAA§164.310(a)(1), HIPAA§164.310(a)(2)(i), HIPAA§164.310(a)(2)(ii), HIPAA§164.310(a)(2)(iii), HIPAA§164.310(b), HIPAA§164.310(c), HIPAA§164.310(d)(1), HIPAA§164.310(d)(2)(iii), ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5
Description	File permissions for `/boot/grub/grub.cfg` should be set to 600. To properly set the permissions of `{{{ grub2_boot_path }}}/grub.cfg`, run the command: $ sudo chmod 600 {{{ grub2_boot_path }}}/grub.cfg
Rationale	Proper permissions ensure that only the root user can modify important boot parameters.

Set Boot Loader Password in grub2

Rule ID	grub2_password
Result	notapplicable
Time	2023-09-07T09:13:07
Severity	high
Identifiers and References	References: ANSSI§BP28(R17), CIS§1.5.1, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS05.10, COBIT5§DSS06.03, COBIT5§DSS06.06, COBIT5§DSS06.10, CUI§3.4.5, DISA§CCI-000213, HIPAA§164.308(a)(1)(ii)(B), HIPAA§164.308(a)(7)(i), HIPAA§164.308(a)(7)(ii)(A), HIPAA§164.310(a)(1), HIPAA§164.310(a)(2)(i), HIPAA§164.310(a)(2)(ii), HIPAA§164.310(a)(2)(iii), HIPAA§164.310(b), HIPAA§164.310(c), HIPAA§164.310(d)(1), HIPAA§164.310(d)(2)(iii), ISA-62443-2009§4.3.3.2.2, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISO27001-2013§A.18.1.4, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.1, ISO27001-2013§A.9.2.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.2.4, ISO27001-2013§A.9.2.6, ISO27001-2013§A.9.3.1, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.2, ISO27001-2013§A.9.4.3, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST-CSF§PR.AC-1, NIST-CSF§PR.AC-4, NIST-CSF§PR.AC-6, NIST-CSF§PR.AC-7, NIST-CSF§PR.PT-3, OSPP§FIA_UAU.1, SRG§SRG-OS-000080-GPOS-00048, STIGID§UBTU-20-010009
Description	The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. Since plaintext passwords are a security risk, generate a hash for the password by running the following command: $ grub2-mkpasswd-pbkdf2 When prompted, enter the password that was selected. Using the hash from the output, modify the `/etc/grub.d/40_custom` file with the following content: set superusers="boot" password_pbkdf2 boot grub.pbkdf2.sha512.VeryLongString NOTE: the bootloader superuser account and password MUST differ from the root account and password. Once the superuser password has been added, update the `grub.cfg` file by running: grub2-mkconfig -o /boot/grub/grub.cfg
Rationale	Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.
Warnings	warning To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation must be automated as a component of machine provisioning, or followed manually as outlined above. Also, do NOT manually add the superuser account and password to the `grub.cfg` file as the grub2-mkconfig command overwrites this file.

Set the UEFI Boot Loader Password

Rule ID	grub2_uefi_password
Result	fail
Time	2023-09-07T09:13:07
Severity	high
Identifiers and References	References: ANSSI§BP28(R17), CIS-CSC§11, CIS-CSC§12, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.03, COBIT5§DSS06.06, CUI§3.4.5, DISA§CCI-000213, HIPAA§164.308(a)(1)(ii)(B), HIPAA§164.308(a)(7)(i), HIPAA§164.308(a)(7)(ii)(A), HIPAA§164.310(a)(1), HIPAA§164.310(a)(2)(i), HIPAA§164.310(a)(2)(ii), HIPAA§164.310(a)(2)(iii), HIPAA§164.310(b), HIPAA§164.310(c), HIPAA§164.310(d)(1), HIPAA§164.310(d)(2)(iii), ISA-62443-2009§4.3.3.2.2, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.1, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST-CSF§PR.AC-4, NIST-CSF§PR.AC-6, NIST-CSF§PR.PT-3, OSPP§FIA_UAU.1, SRG§SRG-OS-000080-GPOS-00048, STIGID§UBTU-20-010009
Description	The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. Since plaintext passwords are a security risk, generate a hash for the password by running the following command: $ grub2-mkpasswd-pbkdf2 When prompted, enter the password that was selected. Using the hash from the output, modify the `/etc/grub.d/40_custom` file with the following content: set superusers="boot" password_pbkdf2 boot grub.pbkdf2.sha512.VeryLongString NOTE: the bootloader superuser account and password MUST differ from the root account and password. Once the superuser password has been added, update the `grub.cfg` file by running: update-grub
Rationale	Password protection on the boot loader configuration ensures users with physical access cannot trivially alter important bootloader settings. These include which kernel to use, and whether to enter single-user mode.
Warnings	warning To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation must be automated as a component of machine provisioning, or followed manually as outlined above. Also, do NOT manually add the superuser account and password to the `grub.cfg` file as the grub2-mkconfig command overwrites this file.

Ensure journald is configured to compress large log files

Rule ID compress_large_logs

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.2.2.2

Description

The journald system includes the capability of compressing overly large files to avoid filling up the system with logs or making the logs unmanageably large. Note: The main configuration file /etc/systemd/journald.conf is read before any of the custom *.conf files. If there are custom configs present, they override the main configuration parameters.

Rationale

Uncompressed large files may unexpectedly fill a filesystem leading to resource unavailability. Compressing logs prior to write can prevent sudden, unexpected filesystem impacts.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if [ -e "/etc/systemd/journald.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*Compress=yes/Id" "/etc/systemd/journald.conf"
else
    touch "/etc/systemd/journald.conf"
fi
cp "/etc/systemd/journald.conf" "/etc/systemd/journald.conf.bak"
# Insert at the end of the file
printf '%s\n' "Compress=yes" >> "/etc/systemd/journald.conf"
# Clean up after ourselves.
rm "/etc/systemd/journald.conf.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Ensure journald is configured to compress large log files
  lineinfile:
    path: /etc/systemd/journald.conf
    create: true
    line: Compress=yes
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - compress_large_logs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure journald is configured to send logs to rsyslog

Rule ID forward_to_syslog

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.2.2.1

Description

Data from journald may be stored in volatile memory or persisted locally on the server. Utilities exist to accept remote export of journald logs, however, use of the rsyslog service provides a consistent means of log collection and export. Notes: - This recommendation assumes that recommendation 4.2.1.5, "Ensure rsyslog is configured to send logs to a remote log host" has been implemented. - As noted in the journald man pages, journald logs may be exported to rsyslog either through the process mentioned here, or through a facility like systemd- journald.service . There are trade-offs involved in each implementation, where ForwardToSyslog will immediately capture all events (and forward to an external log server, if properly configured), but may not capture all boot-up activities. Mechanisms such as systemd-journald.service , on the other hand, will record bootup events, but may delay sending the information to rsyslog, leading to the potential for log manipulation prior to export. Be aware of the limitations of all tools employed to secure a system. - The main configuration file /etc/systemd/journald.conf is read before any of the custom *.conf files. If there are custom configs present, they override the main configuration parameters.

Rationale

Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if [ -e "/etc/systemd/journald.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*ForwardToSyslog=yes/Id" "/etc/systemd/journald.conf"
else
    touch "/etc/systemd/journald.conf"
fi
cp "/etc/systemd/journald.conf" "/etc/systemd/journald.conf.bak"
# Insert at the end of the file
printf '%s\n' "ForwardToSyslog=yes" >> "/etc/systemd/journald.conf"
# Clean up after ourselves.
rm "/etc/systemd/journald.conf.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Ensure journald is configured to send logs to rsyslog
  lineinfile:
    path: /etc/systemd/journald.conf
    create: true
    line: ForwardToSyslog=yes
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - forward_to_syslog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Ensure journald is configured to write logfiles to persistent disk

Rule ID persistent_storage

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§4.2.2.3

Description

Data from journald may be stored in volatile memory or persisted locally on the server. Logs in memory will be lost upon a system reboot. By persisting logs to local disk on the server they are protected from loss. Note: The main configuration file /etc/systemd/journald.conf is read before any of the custom *.conf files. If there are custom configs present, they override the main configuration parameters.

Rationale

Writing log data to disk will provide the ability to forensically reconstruct events which may have impacted the operations or security of a system even after a system crash or reboot.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if [ -e "/etc/systemd/journald.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*Storage=persistent/Id" "/etc/systemd/journald.conf"
else
    touch "/etc/systemd/journald.conf"
fi
cp "/etc/systemd/journald.conf" "/etc/systemd/journald.conf.bak"
# Insert at the end of the file
printf '%s\n' "Storage=persistent" >> "/etc/systemd/journald.conf"
# Clean up after ourselves.
rm "/etc/systemd/journald.conf.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Ensure journald is configured to write logfiles to persistent disk
  lineinfile:
    path: /etc/systemd/journald.conf
    create: true
    line: Storage=persistent
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - persistent_storage
    - restrict_strategy

Ensure logrotate assigns appropriate permissions

Rule ID	ensure_logrotate_permissions
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§4.4
Description	Log files contain logged information from many services on the system, or on log hosts others as well.
Rationale	It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected.

Ensure Logs Sent To Remote Host

Rule ID rsyslog_remote_loghost

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: ANSSI§BP28(R7), ANSSI§NT28(R43), ANSSI§NT12(R5), CIS§4.2.1.5, CIS-CSC§1, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, COBIT5§APO11.04, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI04.04, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§MEA02.01, DISA§CCI-000366, DISA§CCI-001348, DISA§CCI-000136, DISA§CCI-001851, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(5)(ii)(B), HIPAA§164.308(a)(5)(ii)(C), HIPAA§164.308(a)(6)(ii), HIPAA§164.308(a)(8), HIPAA§164.310(d)(2)(iii), HIPAA§164.312(b), HIPAA§164.314(a)(2)(i)(C), HIPAA§164.314(a)(2)(iii), ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISM§0988, ISM§1405, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.17.2.1, NERC-CIP§CIP-003-3 R5.2, NERC-CIP§CIP-004-3 R3.3, NIST§CM-6(a), NIST§AU-4(1), NIST§AU-9(2), NIST-CSF§PR.DS-4, NIST-CSF§PR.PT-1, OSPP§FAU_GEN.1.1.c, SRG§SRG-OS-000479-GPOS-00224, SRG§SRG-OS-000480-GPOS-00227, SRG§SRG-OS-000342-GPOS-00133, VMMSRG§SRG-OS-000032-VMM-000130

Description

To configure rsyslog to send logs to a remote log server, open /etc/rsyslog.conf and read and understand the last section of the file, which describes the multiple directives necessary to activate remote logging. Along with these other directives, the system can be configured to forward its logs to a particular log server by adding or correcting one of the following lines, substituting logcollector appropriately. The choice of protocol depends on the environment of the system; although TCP and RELP provide more reliable message delivery, they may not be supported in all environments.
To use UDP for log message delivery:

*.* @logcollector

To use TCP for log message delivery:

*.* @@logcollector

To use RELP for log message delivery:

*.* :omrelp:logcollector

There must be a resolvable DNS CNAME or Alias record set to "logcollector" for logs to be sent correctly to the centralized logging utility.

Rationale

A log server (loghost) receives syslog messages from one or more systems. This data can be used as an additional log source in the event a system is compromised and its local logs are suspect. Forwarding log messages to a remote loghost also provides system administrators with a centralized place to view the status of multiple hosts within the enterprise.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


rsyslog_remote_loghost_address='logcollector'



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/rsyslog.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^\*\.\*")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "@@$rsyslog_remote_loghost_address"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^\*\.\*\\>" "/etc/rsyslog.conf"; then
    "${sed_command[@]}" "s/^\*\.\*\\>.*/$formatted_output/gi" "/etc/rsyslog.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/rsyslog.conf" >> "/etc/rsyslog.conf"
    printf '%s\n' "$formatted_output" >> "/etc/rsyslog.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value rsyslog_remote_loghost_address # promote to variable
  set_fact:
    rsyslog_remote_loghost_address: !!str logcollector
  tags:
    - always

- name: Set rsyslog remote loghost
  lineinfile:
    dest: /etc/rsyslog.conf
    regexp: ^\*\.\*
    line: '*.* @@{{ rsyslog_remote_loghost_address }}'
    create: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-4(1)
    - NIST-800-53-AU-9(2)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - rsyslog_remote_loghost

Ensure rsyslog is Installed

Rule ID	package_rsyslog_installed
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: ANSSI§BP28(R5), ANSSI§NT28(R46), CIS§4.2.1.1, CIS-CSC§1, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, COBIT5§APO11.04, COBIT5§BAI03.05, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§MEA02.01, DISA§CCI-001311, DISA§CCI-001312, DISA§CCI-000366, HIPAA§164.312(a)(2)(ii), ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, NIST§CM-6(a), NIST-CSF§PR.PT-1, SRG§SRG-OS-000479-GPOS-00224, SRG§SRG-OS-000051-GPOS-00024, SRG§SRG-OS-000480-GPOS-00227
Description	Rsyslog is installed by default. The `rsyslog` package can be installed with the following command: $ apt-get install rsyslog
Rationale	The rsyslog package provides the rsyslog daemon, which provides system logging services.

Enable rsyslog Service

Rule ID	service_rsyslog_enabled
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: ANSSI§BP28(R5), ANSSI§NT28(R46), CIS§4.2.1.2, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO10.01, COBIT5§APO10.03, COBIT5§APO10.04, COBIT5§APO10.05, COBIT5§APO11.04, COBIT5§APO13.01, COBIT5§BAI03.05, COBIT5§BAI04.04, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§MEA01.01, COBIT5§MEA01.02, COBIT5§MEA01.03, COBIT5§MEA01.04, COBIT5§MEA01.05, COBIT5§MEA02.01, DISA§CCI-001311, DISA§CCI-001312, DISA§CCI-001557, DISA§CCI-001665, DISA§CCI-001851, DISA§CCI-000366, HIPAA§164.312(a)(2)(ii), ISA-62443-2009§4.3.2.6.7, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISA-62443-2013§SR 6.1, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, ISO27001-2013§A.14.2.7, ISO27001-2013§A.15.2.1, ISO27001-2013§A.15.2.2, ISO27001-2013§A.17.2.1, NIST§CM-6(a), NIST§AU-4(1), NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§DE.CM-7, NIST-CSF§ID.SC-4, NIST-CSF§PR.DS-4, NIST-CSF§PR.PT-1, SRG§SRG-OS-000269-GPOS-00103, SRG§SRG-OS-000480-GPOS-00227, STIGID§UBTU-20-010432
Description	The `rsyslog` service provides syslog-style logging by default on Ubuntu 20.04. The `rsyslog` service can be enabled with the following command: $ sudo systemctl enable rsyslog.service
Rationale	The `rsyslog` service must be running in order to provide logging services, which are essential to system administration.

Ensure permissions on all logfiles are configured

Rule ID	all_logfile_permissions
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§4.2.3
Description	Log files stored in /var/log/ contain logged information from many services on the system, or on log hosts others as well. Note: You may also need to change the configuration for your logging software or services for any logs that had incorrect permissions.
Rationale	It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected.

Ensure rsyslog default file permissions configured

Rule ID	rsyslog_filecreatemode
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§4.2.1.4
Description	rsyslog will create logfiles that do not already exist on the system. This setting controls what permissions will be applied to these newly created files.
Rationale	It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected.

Trafic in on lo is allowed

Rule ID	ip6tables_allow_in_lo
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§3.5.3.3.2
Description	ip6tables should be configured to allow all inbound traffic on the loopback interface.
Rationale	A properly configured system expects communication on the loopback interface to be possible.
Remediation Shell script: (show) # Remediation is applicable only in certain platforms var_firewall_package='iptables' if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { [ "$var_firewall_package" == "iptables" ]; }; then if ! dpkg-query --show --showformat='${db:Status-Status}\n' "iptables" 2>/dev/null \| grep -q installed; then DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables" fi if ! dpkg-query --show --showformat='${db:Status-Status}\n' "iptables-persistent" 2>/dev/null \| grep -q installed; then debconf-set-selections <<< "iptables-persistent iptables-persistent/autosave_v4 boolean true" debconf-set-selections <<< "iptables-persistent iptables-persistent/autosave_v6 boolean true" DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables-persistent" fi ip6tables -C INPUT -i lo -j ACCEPT 2>/dev/null \|\| ip6tables -A INPUT -i lo -j ACCEPT ip6tables-save -t filter > /etc/iptables/rules.v6 else >&2 echo 'Remediation is not applicable, nothing was done' fi

Traffic out on lo is allowed

Rule ID	ip6tables_allow_out_lo
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§3.5.3.3.2
Description	ip6tables should be configured to allow all outbound traffic on the loopback interface.
Rationale	A properly configured system expects communication on the loopback interface to be possible.
Remediation Shell script: (show) # Remediation is applicable only in certain platforms var_firewall_package='iptables' if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { [ "$var_firewall_package" == "iptables" ]; }; then if ! dpkg-query --show --showformat='${db:Status-Status}\n' "iptables" 2>/dev/null \| grep -q installed; then DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables" fi if ! dpkg-query --show --showformat='${db:Status-Status}\n' "iptables-persistent" 2>/dev/null \| grep -q installed; then debconf-set-selections <<< "iptables-persistent iptables-persistent/autosave_v4 boolean true" debconf-set-selections <<< "iptables-persistent iptables-persistent/autosave_v6 boolean true" DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables-persistent" fi ip6tables -C OUTPUT -o lo -j ACCEPT 2>/dev/null \|\| ip6tables -A OUTPUT -o lo -j ACCEPT ip6tables-save -t filter > /etc/iptables/rules.v6 else >&2 echo 'Remediation is not applicable, nothing was done' fi

Inbound traffic for ::1/128 on any other interface is denied.

Rule ID	ip6tables_deny_in_other_for_localhost6
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§3.5.3.3.2
Description	iptables6 should be configured to forbid all traffic for the localhost6 addresses (::1/128) on interfaces other than the designated lo interface.
Rationale	A properly configured system expects communication on the loopback interface to be secure and only accessible to the local system.
Remediation Shell script: (show) # Remediation is applicable only in certain platforms var_firewall_package='iptables' if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { [ "$var_firewall_package" == "iptables" ]; }; then if ! dpkg-query --show --showformat='${db:Status-Status}\n' "iptables" 2>/dev/null \| grep -q installed; then DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables" fi if ! dpkg-query --show --showformat='${db:Status-Status}\n' "iptables-persistent" 2>/dev/null \| grep -q installed; then debconf-set-selections <<< "iptables-persistent iptables-persistent/autosave_v4 boolean true" debconf-set-selections <<< "iptables-persistent iptables-persistent/autosave_v6 boolean true" DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables-persistent" fi ip6tables -C INPUT -s ::1 -j DROP 2>/dev/null \|\| ip6tables -A INPUT -s ::1 -j DROP ip6tables-save -t filter > /etc/iptables/rules.v6 else >&2 echo 'Remediation is not applicable, nothing was done' fi

Trafic in on lo is allowed

Rule ID	iptables_allow_in_lo
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§3.5.3.2.2
Description	iptables should be configured to allow all inbound traffic on the loopback interface.
Rationale	A properly configured system expects communication on the loopback interface to be possible.
Remediation Shell script: (show) # Remediation is applicable only in certain platforms var_firewall_package='iptables' if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { [ "$var_firewall_package" == "iptables" ]; }; then if ! dpkg-query --show --showformat='${db:Status-Status}\n' "iptables" 2>/dev/null \| grep -q installed; then DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables" fi if ! dpkg-query --show --showformat='${db:Status-Status}\n' "iptables-persistent" 2>/dev/null \| grep -q installed; then debconf-set-selections <<< "iptables-persistent iptables-persistent/autosave_v4 boolean true" debconf-set-selections <<< "iptables-persistent iptables-persistent/autosave_v6 boolean true" DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables-persistent" fi iptables -C INPUT -i lo -j ACCEPT 2>/dev/null \|\| iptables -A INPUT -i lo -j ACCEPT iptables-save -t filter > /etc/iptables/rules.v4 else >&2 echo 'Remediation is not applicable, nothing was done' fi

Traffic out on lo is allowed

Rule ID	iptables_allow_out_lo
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§3.5.3.2.2
Description	iptables should be configured to allow all outbound traffic on the loopback interface.
Rationale	A properly configured system expects communication on the loopback interface to be possible.
Remediation Shell script: (show) # Remediation is applicable only in certain platforms var_firewall_package='iptables' if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { [ "$var_firewall_package" == "iptables" ]; }; then if ! dpkg-query --show --showformat='${db:Status-Status}\n' "iptables" 2>/dev/null \| grep -q installed; then DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables" fi if ! dpkg-query --show --showformat='${db:Status-Status}\n' "iptables-persistent" 2>/dev/null \| grep -q installed; then debconf-set-selections <<< "iptables-persistent iptables-persistent/autosave_v4 boolean true" debconf-set-selections <<< "iptables-persistent iptables-persistent/autosave_v6 boolean true" DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables-persistent" fi iptables -C OUTPUT -o lo -j ACCEPT 2>/dev/null \|\| iptables -A OUTPUT -o lo -j ACCEPT iptables-save -t filter > /etc/iptables/rules.v4 else >&2 echo 'Remediation is not applicable, nothing was done' fi

Inbound traffic for 127.0.0.0/8 on any other interface is denied.

Rule ID	iptables_deny_in_other_for_localhost
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§3.5.3.2.2
Description	iptables should be configured to forbid all traffic for the localhost addresses (127.0.0.0/8) on interfaces other than the designated lo interface.
Rationale	A properly configured system expects communication on the loopback interface to be secure and only accessible to the local system.
Remediation Shell script: (show) # Remediation is applicable only in certain platforms var_firewall_package='iptables' if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { [ "$var_firewall_package" == "iptables" ]; }; then if ! dpkg-query --show --showformat='${db:Status-Status}\n' "iptables" 2>/dev/null \| grep -q installed; then DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables" fi if ! dpkg-query --show --showformat='${db:Status-Status}\n' "iptables-persistent" 2>/dev/null \| grep -q installed; then debconf-set-selections <<< "iptables-persistent iptables-persistent/autosave_v4 boolean true" debconf-set-selections <<< "iptables-persistent iptables-persistent/autosave_v6 boolean true" DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables-persistent" fi iptables -C INPUT -s 127.0.0.0/8 -j DROP 2>/dev/null \|\| iptables -A INPUT -s 127.0.0.0/8 -j DROP iptables-save -t filter > /etc/iptables/rules.v4 else >&2 echo 'Remediation is not applicable, nothing was done' fi

Ensure default deny firewall policy - iptables6

Rule ID	ip6tables_default_deny
Result	fail
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§3.5.3.3.1
Description	With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to white list acceptable usage than to black list unacceptable usage. Notes: Changing firewall settings while connected over network can result in being locked out of the system Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well.
Rationale	With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to white list acceptable usage than to black list unacceptable usage.

Ensure default deny firewall policy

Rule ID	iptables_default_deny
Result	fail
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.3.2.1
Description	With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to white list acceptable usage than to black list unacceptable usage. Notes: Changing firewall settings while connected over network can result in being locked out of the system Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well.
Rationale	With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to white list acceptable usage than to black list unacceptable usage.

Install iptables-persistent Package

Rule ID package_iptables-persistent_installed

Result

fail

Time 2023-09-07T09:13:07

Severity medium

Identifiers and References

References: CIS§3.5.3.1.1, NIST§CM-6(a), SRG§SRG-OS-000480-GPOS-00227

Description

The iptables-persistent package can be installed with the following command:

$ apt-get install iptables-persistent

Rationale

iptables controls the Linux kernel network packet filtering code. iptables allows system operators to set up firewalls and IP masquerading, etc. iptables-persistent is a package that enables saving and restoring of firewall rules on startup.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

# Remediation is applicable only in certain platforms

var_firewall_package='iptables'
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] || [ "$var_firewall_package" == "iptables" ]; then

DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables-persistent"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

- name: XCCDF Value var_firewall_package # promote to variable
  set_fact:
    var_firewall_package: !!str iptables
  tags:
    - always

- name: Ensure iptables-persistent is installed
  package:
    name: iptables-persistent
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    or var_firewall_package == iptables
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_iptables-persistent_installed

Remediation Puppet snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

include install_iptables-persistent

class install_iptables-persistent {
  package { 'iptables-persistent':
    ensure => 'installed',
  }
}

Remediation script: (show)


[[packages]]
name = "iptables-persistent"
version = "*"

Install iptables Package

Rule ID	package_iptables_installed
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§3.5.3.1.1, NIST§CM-6(a), SRG§SRG-OS-000480-GPOS-00227
Description	The `iptables` package can be installed with the following command: $ apt-get install iptables
Rationale	`iptables` controls the Linux kernel network packet filtering code. `iptables` allows system operators to set up firewalls and IP masquerading, etc.

Remove iptables-persistent Package

Rule ID	package_iptables-persistent_removed
Result	pass
Time	2023-09-07T09:13:07
Severity	medium
Identifiers and References	References: CIS§3.5.1.2
Description	The iptables-persistent is a boot-time loader for netfilter rules, iptables plugin. The `iptables-persistent` package can be removed with the following command: $ apt-get remove iptables-persistent
Rationale	Running both iptables-persistent and another iptables-based firewall (such as UFW or firewalld) may lead to conflicts.

Configure Accepting Router Advertisements on All IPv6 Interfaces

Rule ID sysctl_net_ipv6_conf_all_accept_ra

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

Description

To set the runtime status of the net.ipv6.conf.all.accept_ra kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.all.accept_ra=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.all.accept_ra = 0

Rationale

An illicit router advertisement message could result in a man-in-the-middle attack.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_all_accept_ra_value='0'



#
# Set runtime for net.ipv6.conf.all.accept_ra
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.accept_ra="$sysctl_net_ipv6_conf_all_accept_ra_value"

#
# If net.ipv6.conf.all.accept_ra present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_ra = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^net.ipv6.conf.all.accept_ra")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_ra_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_ra\\>" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.all.accept_ra\\>.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/sysctl.conf" >> "/etc/sysctl.conf"
    printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_ra_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_ra_value: !!str 0
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_ra is set
  sysctl:
    name: net.ipv6.conf.all.accept_ra
    value: '{{ sysctl_net_ipv6_conf_all_accept_ra_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra

Disable Accepting ICMP Redirects for All IPv6 Interfaces

Rule ID sysctl_net_ipv6_conf_all_accept_redirects

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

Description

To set the runtime status of the net.ipv6.conf.all.accept_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.all.accept_redirects = 0

Rationale

An illicit ICMP redirect message could result in a man-in-the-middle attack.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_all_accept_redirects_value='0'



#
# Set runtime for net.ipv6.conf.all.accept_redirects
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.accept_redirects="$sysctl_net_ipv6_conf_all_accept_redirects_value"

#
# If net.ipv6.conf.all.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_redirects = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^net.ipv6.conf.all.accept_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_redirects\\>" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.all.accept_redirects\\>.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/sysctl.conf" >> "/etc/sysctl.conf"
    printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_redirects_value: !!str 0
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_redirects is set
  sysctl:
    name: net.ipv6.conf.all.accept_redirects
    value: '{{ sysctl_net_ipv6_conf_all_accept_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_redirects

Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces

Rule ID sysctl_net_ipv6_conf_all_accept_source_route

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

References: ANSSI§BP28(R22), CIS§3.3.1, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§4, CIS-CSC§6, CIS-CSC§8, CIS-CSC§9, COBIT5§APO01.06, COBIT5§APO13.01, COBIT5§DSS01.05, COBIT5§DSS03.01, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, CUI§3.1.20, DISA§CCI-000366, ISA-62443-2009§4.2.3.4, ISA-62443-2009§4.3.3.4, ISA-62443-2009§4.4.3.3, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.12.1.1, ISO27001-2013§A.12.1.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.2, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.2, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST-CSF§DE.AE-1, NIST-CSF§ID.AM-3, NIST-CSF§PR.AC-5, NIST-CSF§PR.DS-5, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227

Description

To set the runtime status of the net.ipv6.conf.all.accept_source_route kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.all.accept_source_route = 0

Rationale

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router.

Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_all_accept_source_route_value='0'



#
# Set runtime for net.ipv6.conf.all.accept_source_route
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.accept_source_route="$sysctl_net_ipv6_conf_all_accept_source_route_value"

#
# If net.ipv6.conf.all.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_source_route = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^net.ipv6.conf.all.accept_source_route")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_source_route_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_source_route\\>" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.all.accept_source_route\\>.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/sysctl.conf" >> "/etc/sysctl.conf"
    printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_source_route_value: !!str 0
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.accept_source_route is set
  sysctl:
    name: net.ipv6.conf.all.accept_source_route
    value: '{{ sysctl_net_ipv6_conf_all_accept_source_route_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_source_route

Disable Kernel Parameter for IPv6 Forwarding

Rule ID sysctl_net_ipv6_conf_all_forwarding

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

Description

To set the runtime status of the net.ipv6.conf.all.forwarding kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.all.forwarding=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.all.forwarding = 0

Rationale

IP forwarding permits the kernel to forward packets from one network interface to another. The ability to forward packets between two networks is only appropriate for systems acting as routers.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_all_forwarding_value='0'



#
# Set runtime for net.ipv6.conf.all.forwarding
#
/sbin/sysctl -q -n -w net.ipv6.conf.all.forwarding="$sysctl_net_ipv6_conf_all_forwarding_value"

#
# If net.ipv6.conf.all.forwarding present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.forwarding = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^net.ipv6.conf.all.forwarding")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_forwarding_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.forwarding\\>" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.all.forwarding\\>.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/sysctl.conf" >> "/etc/sysctl.conf"
    printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: XCCDF Value sysctl_net_ipv6_conf_all_forwarding_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_forwarding_value: !!str 0
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.all.forwarding is set
  sysctl:
    name: net.ipv6.conf.all.forwarding
    value: '{{ sysctl_net_ipv6_conf_all_forwarding_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_forwarding

Disable Accepting Router Advertisements on all IPv6 Interfaces by Default

Rule ID sysctl_net_ipv6_conf_default_accept_ra

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

Description

To set the runtime status of the net.ipv6.conf.default.accept_ra kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.default.accept_ra=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.default.accept_ra = 0

Rationale

An illicit router advertisement message could result in a man-in-the-middle attack.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_default_accept_ra_value='0'



#
# Set runtime for net.ipv6.conf.default.accept_ra
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra="$sysctl_net_ipv6_conf_default_accept_ra_value"

#
# If net.ipv6.conf.default.accept_ra present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^net.ipv6.conf.default.accept_ra")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_ra_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_ra\\>" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.default.accept_ra\\>.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/sysctl.conf" >> "/etc/sysctl.conf"
    printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_value: !!str 0
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_ra is set
  sysctl:
    name: net.ipv6.conf.default.accept_ra
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra

Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces

Rule ID sysctl_net_ipv6_conf_default_accept_redirects

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

Description

To set the runtime status of the net.ipv6.conf.default.accept_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.default.accept_redirects = 0

Rationale

An illicit ICMP redirect message could result in a man-in-the-middle attack.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_default_accept_redirects_value='0'



#
# Set runtime for net.ipv6.conf.default.accept_redirects
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.accept_redirects="$sysctl_net_ipv6_conf_default_accept_redirects_value"

#
# If net.ipv6.conf.default.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_redirects = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^net.ipv6.conf.default.accept_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_redirects\\>" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.default.accept_redirects\\>.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/sysctl.conf" >> "/etc/sysctl.conf"
    printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_redirects_value: !!str 0
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_redirects is set
  sysctl:
    name: net.ipv6.conf.default.accept_redirects
    value: '{{ sysctl_net_ipv6_conf_default_accept_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_redirects

Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default

Rule ID sysctl_net_ipv6_conf_default_accept_source_route

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

References: ANSSI§BP28(R22), CIS§3.3.1, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§4, CIS-CSC§6, CIS-CSC§8, CIS-CSC§9, COBIT5§APO01.06, COBIT5§APO13.01, COBIT5§DSS01.05, COBIT5§DSS03.01, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, CUI§3.1.20, DISA§CCI-000366, ISA-62443-2009§4.2.3.4, ISA-62443-2009§4.3.3.4, ISA-62443-2009§4.4.3.3, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.12.1.1, ISO27001-2013§A.12.1.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.2, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.2, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST§CM-6(b), NIST§CM-6.1(iv), NIST-CSF§DE.AE-1, NIST-CSF§ID.AM-3, NIST-CSF§PR.AC-5, NIST-CSF§PR.DS-5, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227

Description

To set the runtime status of the net.ipv6.conf.default.accept_source_route kernel parameter, run the following command:

$ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv6.conf.default.accept_source_route = 0

Rationale

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sysctl_net_ipv6_conf_default_accept_source_route_value='0'



#
# Set runtime for net.ipv6.conf.default.accept_source_route
#
/sbin/sysctl -q -n -w net.ipv6.conf.default.accept_source_route="$sysctl_net_ipv6_conf_default_accept_source_route_value"

#
# If net.ipv6.conf.default.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_source_route = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^net.ipv6.conf.default.accept_source_route")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_source_route_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_source_route\\>" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv6.conf.default.accept_source_route\\>.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/sysctl.conf" >> "/etc/sysctl.conf"
    printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_source_route_value: !!str 0
  tags:
    - always

- name: Ensure sysctl net.ipv6.conf.default.accept_source_route is set
  sysctl:
    name: net.ipv6.conf.default.accept_source_route
    value: '{{ sysctl_net_ipv6_conf_default_accept_source_route_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_source_route

Disable Accepting ICMP Redirects for All IPv4 Interfaces

Rule ID	sysctl_net_ipv4_conf_all_accept_redirects
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: ANSSI§BP28(R22), CIS§3.3.2, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.10.1.1, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.06, CUI§3.1.20, DISA§CCI-000366, DISA§CCI-001503, DISA§CCI-001551, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.17.2.1, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST§SC-7(a), NIST-CSF§DE.CM-1, NIST-CSF§PR.DS-4, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, SRG§SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.all.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.accept_redirects = 0
Rationale	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required."

Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces

Rule ID	sysctl_net_ipv4_conf_all_accept_source_route
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: ANSSI§BP28(R22), CIS§3.3.1, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO01.06, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.03, COBIT5§DSS01.05, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.02, COBIT5§DSS06.06, CUI§3.1.20, DISA§CCI-000366, ISA-62443-2009§4.2.3.4, ISA-62443-2009§4.3.3.4, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2009§4.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.12.1.1, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.2, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.2, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.17.2.1, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-007-3 R4, NERC-CIP§CIP-007-3 R4.1, NERC-CIP§CIP-007-3 R4.2, NERC-CIP§CIP-007-3 R5.1, NIST§CM-7(a), NIST§CM-7(b), NIST§SC-5, NIST§CM-6(a), NIST§SC-7(a), NIST-CSF§DE.AE-1, NIST-CSF§DE.CM-1, NIST-CSF§ID.AM-3, NIST-CSF§PR.AC-5, NIST-CSF§PR.DS-4, NIST-CSF§PR.DS-5, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.all.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.accept_source_route = 0
Rationale	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces

Rule ID	sysctl_net_ipv4_conf_all_log_martians
Result	pass
Time	2023-09-07T09:13:08
Severity	unknown
Identifiers and References	References: ANSSI§BP28(R22), CIS§3.3.4, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.06, CUI§3.1.20, DISA§CCI-000126, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.17.2.1, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§SC-5(3)(a), NIST-CSF§DE.CM-1, NIST-CSF§PR.AC-3, NIST-CSF§PR.DS-4, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.all.log_martians` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.log_martians=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.log_martians = 1
Rationale	The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.

Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces

Rule ID sysctl_net_ipv4_conf_all_rp_filter

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

Description

To set the runtime status of the net.ipv4.conf.all.rp_filter kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.all.rp_filter=1

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.all.rp_filter = 1

Rationale

Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_all_rp_filter_value='1'



#
# Set runtime for net.ipv4.conf.all.rp_filter
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.rp_filter="$sysctl_net_ipv4_conf_all_rp_filter_value"

#
# If net.ipv4.conf.all.rp_filter present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.rp_filter = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^net.ipv4.conf.all.rp_filter")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_rp_filter_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.rp_filter\\>" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.rp_filter\\>.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/sysctl.conf" >> "/etc/sysctl.conf"
    printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: XCCDF Value sysctl_net_ipv4_conf_all_rp_filter_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_rp_filter_value: !!str 1
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.rp_filter is set
  sysctl:
    name: net.ipv4.conf.all.rp_filter
    value: '{{ sysctl_net_ipv4_conf_all_rp_filter_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_rp_filter

Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces

Rule ID sysctl_net_ipv4_conf_all_secure_redirects

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

Description

To set the runtime status of the net.ipv4.conf.all.secure_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.all.secure_redirects = 0

Rationale

Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_all_secure_redirects_value='0'



#
# Set runtime for net.ipv4.conf.all.secure_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.all.secure_redirects="$sysctl_net_ipv4_conf_all_secure_redirects_value"

#
# If net.ipv4.conf.all.secure_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.secure_redirects = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^net.ipv4.conf.all.secure_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_secure_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.secure_redirects\\>" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.all.secure_redirects\\>.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/sysctl.conf" >> "/etc/sysctl.conf"
    printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: XCCDF Value sysctl_net_ipv4_conf_all_secure_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_secure_redirects_value: !!str 0
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.all.secure_redirects is set
  sysctl:
    name: net.ipv4.conf.all.secure_redirects
    value: '{{ sysctl_net_ipv4_conf_all_secure_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_secure_redirects

Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces

Rule ID	sysctl_net_ipv4_conf_default_accept_redirects
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: ANSSI§BP28(R22), CIS§3.3.2, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.10.1.1, COBIT5§APO01.06, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.03, COBIT5§DSS01.05, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.02, COBIT5§DSS06.06, CUI§3.1.20, DISA§CCI-000366, DISA§CCI-001551, ISA-62443-2009§4.2.3.4, ISA-62443-2009§4.3.3.4, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2009§4.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.12.1.1, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.2, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.2, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.17.2.1, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST§SC-7(a), NIST-CSF§DE.AE-1, NIST-CSF§DE.CM-1, NIST-CSF§ID.AM-3, NIST-CSF§PR.AC-5, NIST-CSF§PR.DS-4, NIST-CSF§PR.DS-5, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.default.accept_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.accept_redirects = 0
Rationale	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack. This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required.

Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default

Rule ID	sysctl_net_ipv4_conf_default_accept_source_route
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: ANSSI§BP28(R22), CIS§3.3.1, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.10.1.1, COBIT5§APO01.06, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.03, COBIT5§DSS01.05, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.02, COBIT5§DSS06.06, CUI§3.1.20, DISA§CCI-000366, DISA§CCI-001551, ISA-62443-2009§4.2.3.4, ISA-62443-2009§4.3.3.4, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2009§4.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.12.1.1, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.2, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.2, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.17.2.1, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-007-3 R4, NERC-CIP§CIP-007-3 R4.1, NERC-CIP§CIP-007-3 R4.2, NERC-CIP§CIP-007-3 R5.1, NIST§CM-7(a), NIST§CM-7(b), NIST§SC-5, NIST§SC-7(a), NIST-CSF§DE.AE-1, NIST-CSF§DE.CM-1, NIST-CSF§ID.AM-3, NIST-CSF§PR.AC-5, NIST-CSF§PR.DS-4, NIST-CSF§PR.DS-5, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.default.accept_source_route` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.accept_source_route = 0
Rationale	Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required, such as when IPv4 forwarding is enabled and the system is legitimately functioning as a router.

Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default

Rule ID	sysctl_net_ipv4_conf_default_log_martians
Result	pass
Time	2023-09-07T09:13:08
Severity	unknown
Identifiers and References	References: CIS§3.3.4, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.03, COBIT5§DSS01.04, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.06, CUI§3.1.20, DISA§CCI-000126, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.17.2.1, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§SC-5(3)(a), NIST-CSF§DE.CM-1, NIST-CSF§PR.AC-3, NIST-CSF§PR.DS-4, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.default.log_martians` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.log_martians=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.log_martians = 1
Rationale	The presence of "martian" packets (which have impossible addresses) as well as spoofed packets, source-routed packets, and redirects could be a sign of nefarious network activity. Logging these packets enables this activity to be detected.

Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default

Rule ID sysctl_net_ipv4_conf_default_rp_filter

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

References: ANSSI§BP28(R22), CIS§3.3.7, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§2, CIS-CSC§4, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO01.06, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§DSS01.03, COBIT5§DSS01.05, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, CUI§3.1.20, DISA§CCI-000366, ISA-62443-2009§4.2.3.4, ISA-62443-2009§4.3.3.4, ISA-62443-2009§4.4.3.3, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.12.1.1, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.2, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.2, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.17.2.1, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST§SC-7(a), NIST-CSF§DE.AE-1, NIST-CSF§DE.CM-1, NIST-CSF§ID.AM-3, NIST-CSF§PR.AC-5, NIST-CSF§PR.DS-4, NIST-CSF§PR.DS-5, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227

Description

To set the runtime status of the net.ipv4.conf.default.rp_filter kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.default.rp_filter=1

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.default.rp_filter = 1

Rationale

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_default_rp_filter_value='1'



#
# Set runtime for net.ipv4.conf.default.rp_filter
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.rp_filter="$sysctl_net_ipv4_conf_default_rp_filter_value"

#
# If net.ipv4.conf.default.rp_filter present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.rp_filter = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^net.ipv4.conf.default.rp_filter")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_rp_filter_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.rp_filter\\>" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.default.rp_filter\\>.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/sysctl.conf" >> "/etc/sysctl.conf"
    printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: XCCDF Value sysctl_net_ipv4_conf_default_rp_filter_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_rp_filter_value: !!str 1
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.rp_filter is set
  sysctl:
    name: net.ipv4.conf.default.rp_filter
    value: '{{ sysctl_net_ipv4_conf_default_rp_filter_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_rp_filter

Configure Kernel Parameter for Accepting Secure Redirects By Default

Rule ID sysctl_net_ipv4_conf_default_secure_redirects

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

Description

To set the runtime status of the net.ipv4.conf.default.secure_redirects kernel parameter, run the following command:

$ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

net.ipv4.conf.default.secure_redirects = 0

Rationale

Accepting "secure" ICMP redirects (from those gateways listed as default gateways) has few legitimate uses. It should be disabled unless it is absolutely required.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sysctl_net_ipv4_conf_default_secure_redirects_value='0'



#
# Set runtime for net.ipv4.conf.default.secure_redirects
#
/sbin/sysctl -q -n -w net.ipv4.conf.default.secure_redirects="$sysctl_net_ipv4_conf_default_secure_redirects_value"

#
# If net.ipv4.conf.default.secure_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.secure_redirects = value" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^net.ipv4.conf.default.secure_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_secure_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.secure_redirects\\>" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^net.ipv4.conf.default.secure_redirects\\>.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/sysctl.conf" >> "/etc/sysctl.conf"
    printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: XCCDF Value sysctl_net_ipv4_conf_default_secure_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_secure_redirects_value: !!str 0
  tags:
    - always

- name: Ensure sysctl net.ipv4.conf.default.secure_redirects is set
  sysctl:
    name: net.ipv4.conf.default.secure_redirects
    value: '{{ sysctl_net_ipv4_conf_default_secure_redirects_value }}'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_secure_redirects

Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces

Rule ID	sysctl_net_ipv4_icmp_echo_ignore_broadcasts
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.3.5, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.10.1.1, COBIT5§APO01.06, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.03, COBIT5§DSS01.05, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.02, COBIT5§DSS06.06, CUI§3.1.20, DISA§CCI-000366, ISA-62443-2009§4.2.3.4, ISA-62443-2009§4.3.3.4, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2009§4.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.12.1.1, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.2, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.2, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.17.2.1, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-007-3 R4, NERC-CIP§CIP-007-3 R4.1, NERC-CIP§CIP-007-3 R4.2, NERC-CIP§CIP-007-3 R5.1, NIST§CM-7(a), NIST§CM-7(b), NIST§SC-5, NIST-CSF§DE.AE-1, NIST-CSF§DE.CM-1, NIST-CSF§ID.AM-3, NIST-CSF§PR.AC-5, NIST-CSF§PR.DS-4, NIST-CSF§PR.DS-5, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.icmp_echo_ignore_broadcasts` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.icmp_echo_ignore_broadcasts = 1
Rationale	Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks. Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network.

Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces

Rule ID	sysctl_net_ipv4_icmp_ignore_bogus_error_responses
Result	pass
Time	2023-09-07T09:13:08
Severity	unknown
Identifiers and References	References: ANSSI§BP28(R22), CIS§3.3.6, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.06, CUI§3.1.20, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.17.2.1, ISO27001-2013§A.9.1.2, NERC-CIP§CIP-007-3 R4, NERC-CIP§CIP-007-3 R4.1, NERC-CIP§CIP-007-3 R4.2, NERC-CIP§CIP-007-3 R5.1, NIST§CM-7(a), NIST§CM-7(b), NIST§SC-5, NIST-CSF§DE.CM-1, NIST-CSF§PR.DS-4, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, SRG§SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.icmp_ignore_bogus_error_responses` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.icmp_ignore_bogus_error_responses = 1
Rationale	Ignoring bogus ICMP error responses reduces log size, although some activity would not be logged.

Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces

Rule ID	sysctl_net_ipv4_tcp_syncookies
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: ANSSI§BP28(R22), CIS§3.3.8, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§2, CIS-CSC§4, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.10.1.1, COBIT5§APO01.06, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§DSS01.03, COBIT5§DSS01.05, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, CUI§3.1.20, DISA§CCI-000366, DISA§CCI-001095, ISA-62443-2009§4.2.3.4, ISA-62443-2009§4.3.3.4, ISA-62443-2009§4.4.3.3, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.12.1.1, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.2, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.2, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.17.2.1, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-7(a), NIST§CM-7(b), NIST§SC-5(1), NIST§SC-5(2), NIST§SC-5(3)(a), NIST§CM-6(a), NIST-CSF§DE.AE-1, NIST-CSF§DE.CM-1, NIST-CSF§ID.AM-3, NIST-CSF§PR.AC-5, NIST-CSF§PR.DS-4, NIST-CSF§PR.DS-5, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227, SRG§SRG-OS-000420-GPOS-00186, SRG§SRG-OS-000142-GPOS-00071, STIGID§UBTU-20-010412
Description	To set the runtime status of the `net.ipv4.tcp_syncookies` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.tcp_syncookies=1 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.tcp_syncookies = 1
Rationale	A TCP SYN flood attack can cause a denial of service by filling a system's TCP connection table with connections in the SYN_RCVD state. Syncookies can be used to track a connection when a subsequent ACK is received, verifying the initiator is attempting a valid connection and is not a flood source. This feature is activated when a flood condition is detected, and enables the system to continue servicing valid connection requests.

Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces

Rule ID	sysctl_net_ipv4_conf_all_send_redirects
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: ANSSI§BP28(R22), CIS§3.2.1, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.10.1.1, COBIT5§APO01.06, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.03, COBIT5§DSS01.05, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.02, COBIT5§DSS06.06, CUI§3.1.20, DISA§CCI-000366, ISA-62443-2009§4.2.3.4, ISA-62443-2009§4.3.3.4, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2009§4.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.12.1.1, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.2, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.2, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.17.2.1, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-007-3 R4, NERC-CIP§CIP-007-3 R4.1, NERC-CIP§CIP-007-3 R4.2, NERC-CIP§CIP-007-3 R5.1, NIST§CM-7(a), NIST§CM-7(b), NIST§SC-5, NIST§CM-6(a), NIST§SC-7(a), NIST-CSF§DE.AE-1, NIST-CSF§DE.CM-1, NIST-CSF§ID.AM-3, NIST-CSF§PR.AC-5, NIST-CSF§PR.DS-4, NIST-CSF§PR.DS-5, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.all.send_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.send_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.all.send_redirects = 0
Rationale	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.

Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default

Rule ID	sysctl_net_ipv4_conf_default_send_redirects
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: ANSSI§BP28(R22), CIS§3.2.1, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§2, CIS-CSC§3, CIS-CSC§4, CIS-CSC§6, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, CJIS§5.10.1.1, COBIT5§APO01.06, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.03, COBIT5§DSS01.05, COBIT5§DSS03.01, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.02, COBIT5§DSS06.06, CUI§3.1.20, DISA§CCI-000366, ISA-62443-2009§4.2.3.4, ISA-62443-2009§4.3.3.4, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2009§4.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.12.1.1, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.2, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.2, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.17.2.1, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-007-3 R4, NERC-CIP§CIP-007-3 R4.1, NERC-CIP§CIP-007-3 R4.2, NERC-CIP§CIP-007-3 R5.1, NIST§CM-7(a), NIST§CM-7(b), NIST§SC-5, NIST§CM-6(a), NIST§SC-7(a), NIST-CSF§DE.AE-1, NIST-CSF§DE.CM-1, NIST-CSF§ID.AM-3, NIST-CSF§PR.AC-5, NIST-CSF§PR.DS-4, NIST-CSF§PR.DS-5, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.conf.default.send_redirects` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.send_redirects=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.conf.default.send_redirects = 0
Rationale	ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table possibly revealing portions of the network topology. The ability to send ICMP redirects is only appropriate for systems acting as routers.

Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces

Rule ID	sysctl_net_ipv4_ip_forward
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: ANSSI§BP28(R22), CIS§3.2.2, CIS-CSC§1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§3, CIS-CSC§7, CIS-CSC§8, CIS-CSC§9, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.06, CUI§3.1.20, DISA§CCI-000366, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.17.2.1, ISO27001-2013§A.9.1.2, NERC-CIP§CIP-007-3 R4, NERC-CIP§CIP-007-3 R4.1, NERC-CIP§CIP-007-3 R4.2, NERC-CIP§CIP-007-3 R5.1, NIST§CM-7(a), NIST§CM-7(b), NIST§SC-5, NIST§CM-6(a), NIST§SC-7(a), NIST-CSF§DE.CM-1, NIST-CSF§PR.DS-4, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, NIST-CSF§PR.PT-4, SRG§SRG-OS-000480-GPOS-00227
Description	To set the runtime status of the `net.ipv4.ip_forward` kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.ip_forward=0 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: net.ipv4.ip_forward = 0
Rationale	Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this capability is used when not required, system network information may be unnecessarily transmitted across the network.
Warnings	warning Certain technologies such as virtual machines, containers, etc. rely on IPv4 forwarding to enable and use networking. Disabling IPv4 forwarding would cause those technologies to stop working. Therefore, this rule should not be used in profiles or benchmarks that target usage of IPv4 forwarding.

Trafic in on lo is allowed

Rule ID	nftables_allow_in_lo
Result	notapplicable
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.2.6
Description	nftables should be configured to allow all inbound traffic on the loopback interface.
Rationale	A properly configured system expects communication on the loopback interface to be possible.

Inbound traffic for 127.0.0.0/8 on any other interface is denied.

Rule ID	nftables_deny_in_other_for_localhost
Result	notapplicable
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.2.6
Description	nftables should be configured to forbid all traffic for the localhost addresses (127.0.0.0/8) on interfaces other than the designated lo interface.
Rationale	A properly configured system expects communication on the loopback interface to be secure and only accessible to the local system.

Inbound traffic for ::1/128 on any other interface is denied.

Rule ID	nftables_deny_in_other_for_localhost6
Result	notapplicable
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.2.6
Description	nftables should be configured to forbid all traffic for the localhost6 addresses (::1/128) on interfaces other than the designated lo interface.
Rationale	A properly configured system expects communication on the loopback interface to be secure and only accessible to the local system.

Install nftables Package

Rule ID	package_nftables_installed
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.2.1
Description	The `nftables` package can be installed with the following command: $ apt-get install nftables
Rationale	nftables is a subsystem of the Linux kernel that can protect against threats originating from within a corporate network to include malicious mobile code and poorly configured software on a host.

Remove nftables Package

Rule ID	package_nftables_removed
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.3.1.2
Description	The `nftables` package can be removed with the following command: $ apt-get remove nftables
Rationale	nftables is a subsystem of the Linux kernel that can protect against threats originating from within a corporate network to include malicious mobile code and poorly configured software on a host.

Verify nftables Enabled

Rule ID	service_nftables_enabled
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.2.9
Description	The `nftables` service can be enabled with the following command: $ sudo systemctl enable nftables.service
Rationale	The nftables service must be enabled and running in order for nftables to protect the system.

Ensure default deny firewall policy

Rule ID	nftables_default_deny
Result	notapplicable
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.2.8
Description	Base chain policy is the default verdict that will be applied to packets reaching the end of the chain.
Rationale	There are two policies: accept (Default) and drop. If the policy is set to accept, the firewall will accept any packet that is not configured to be denied and the packet will continue transversing the network stack. It is easier to white list acceptable usage than to black list unacceptable usage.

Ensure base chains exist

Rule ID	nftables_ensure_base_chain_exist
Result	notapplicable
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.2.5
Description	Chains are containers for rules. They exist in two kinds, base chains and regular chains. A base chain is an entry point for packets from the networking stack, a regular chain may be used as jump target and is used for better rule organization.
Rationale	If a base chain doesn't exist with a hook for input, forward, and delete, packets that would flow through those chains will not be touched by nftables.

Ensure a table exists

Rule ID	nftables_ensure_table_exists
Result	notapplicable
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.2.4
Description	Tables hold chains. Each table only has one address family and only applies to packets of this family. Tables can have one of five families.
Rationale	nftables doesn't have any default tables. Without a table being build, nftables will not filter network traffic.

Ensure nftables rules are permanent

Rule ID	nftables_permanent_rules
Result	notapplicable
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.2.10
Description	nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames. The nftables service reads the /etc/nftables.conf file for a nftables file or files to include in the nftables ruleset. A nftables ruleset containing the input, forward, and output base chains allow network traffic to be filtered.
Rationale	Changes made to nftables ruleset only affect the live system, you will also need to configure the nftables ruleset to apply on boot.

Trafic in on lo is allowed

Rule ID	ufw_allow_in_lo
Result	notapplicable
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.1.4
Description	UFW should be configured to allow all inbound traffic on the loopback interface.
Rationale	A properly configured system expects communication on the loopback interface to be possible.

Traffic out on lo is allowed

Rule ID	ufw_allow_out_lo
Result	notapplicable
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.1.4
Description	UFW should be configured to allow all outbound traffic on the loopback interface.
Rationale	A properly configured system expects communication on the loopback interface to be possible.

Inbound traffic for 127.0.0.0/8 on any other interface is denied.

Rule ID	ufw_deny_in_other_for_localhost
Result	notapplicable
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.1.4
Description	UFW should be configured to forbid all traffic for the localhost addresses (127.0.0.0/8) on interfaces other than the designated lo interface.
Rationale	A properly configured system expects communication on the loopback interface to be secure and only accessible to the local system.

Inbound traffic for ::1/128 on any other interface is denied.

Rule ID	ufw_deny_in_other_for_localhost6
Result	notapplicable
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.1.4
Description	UFW should be configured to forbid all traffic for the localhost6 addresses (::1/128) on interfaces other than the designated lo interface.
Rationale	A properly configured system expects communication on the loopback interface to be secure and only accessible to the local system.

Install ufw Package

Rule ID	package_ufw_installed
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.1.1, DISA§CCI-002314, SRG§SRG-OS-000297-GPOS-00115, STIGID§UBTU-20-010433
Description	The `ufw` package can be installed with the following command: $ apt-get install ufw
Rationale	`ufw` controls the Linux kernel network packet filtering code. `ufw` allows system operators to set up firewalls and IP masquerading, etc.

Remove ufw Package

Rule ID package_ufw_removed

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

References: CIS§3.5.2.2

Description

The ufw package can be removed with the following command:

$ apt-get remove ufw

Rationale

ufw controls the Linux kernel network packet filtering code. ufw allows system operators to set up firewalls and IP masquerading, etc.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	disable

# Remediation is applicable only in certain platforms

var_firewall_package='iptables'
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { { [ -n "$var_firewall_package" ] && [ "$var_firewall_package" != "ufw" ] ; }; }; then

# CAUTION: This remediation script will remove ufw
#	   from the system, and may remove any packages
#	   that depend on ufw. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

DEBIAN_FRONTEND=noninteractive apt-get remove -y "ufw"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	disable

- name: XCCDF Value var_firewall_package # promote to variable
  set_fact:
    var_firewall_package: !!str iptables
  tags:
    - always

- name: Ensure ufw is removed
  package:
    name: ufw
    state: absent
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - var_firewall_package and var_firewall_package != "ufw"
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_ufw_removed

Remediation Puppet snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	disable

include remove_ufw

class remove_ufw {
  package { 'ufw':
    ensure => 'purged',
  }
}

Verify ufw Enabled

Rule ID	service_ufw_enabled
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.1.3, DISA§CCI-002314, SRG§SRG-OS-000297-GPOS-00115, STIGID§UBTU-20-010434
Description	The `ufw` service can be enabled with the following command: $ sudo systemctl enable ufw.service
Rationale	The ufw service must be enabled and running in order for ufw to protect the system

Ensure default deny firewall policy

Rule ID	ufw_default_deny
Result	notapplicable
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.5.1.7
Description	A default deny policy on connections ensures that any unconfigured network usage will be rejected. Note: Any port or protocol without a explicit allow before the default deny will be blocked.
Rationale	With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to allow acceptable usage than to block unacceptable usage.

Disable DCCP Support

Rule ID kernel_module_dccp_disabled

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

Description

The Datagram Congestion Control Protocol (DCCP) is a relatively new transport layer protocol, designed to support streaming media and telephony. To configure the system to prevent the dccp kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install dccp /bin/true

Rationale

Disabling DCCP protects the system against exploitation of any flaws in its implementation.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install dccp" /etc/modprobe.d/dccp.conf ; then
	
	sed -i 's#^install dccp.*#install dccp /bin/true#g' /etc/modprobe.d/dccp.conf
else
	echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/dccp.conf
	echo "install dccp /bin/true" >> /etc/modprobe.d/dccp.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: Ensure kernel module 'dccp' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/dccp.conf
    regexp: dccp
    line: install dccp /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_dccp_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required

Disable RDS Support

Rule ID kernel_module_rds_disabled

Result

fail

Time 2023-09-07T09:13:08

Severity low

Identifiers and References

Description

The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide reliable high-bandwidth, low-latency communications between nodes in a cluster. To configure the system to prevent the rds kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install rds /bin/true

Rationale

Disabling RDS protects the system against exploitation of any flaws in its implementation.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install rds" /etc/modprobe.d/rds.conf ; then
	
	sed -i 's#^install rds.*#install rds /bin/true#g' /etc/modprobe.d/rds.conf
else
	echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/rds.conf
	echo "install rds /bin/true" >> /etc/modprobe.d/rds.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: Ensure kernel module 'rds' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/rds.conf
    regexp: rds
    line: install rds /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_rds_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required

Disable SCTP Support

Rule ID kernel_module_sctp_disabled

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

Description

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection. To configure the system to prevent the sctp kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install sctp /bin/true

Rationale

Disabling SCTP protects the system against exploitation of any flaws in its implementation.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install sctp" /etc/modprobe.d/sctp.conf ; then
	
	sed -i 's#^install sctp.*#install sctp /bin/true#g' /etc/modprobe.d/sctp.conf
else
	echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/sctp.conf
	echo "install sctp /bin/true" >> /etc/modprobe.d/sctp.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: Ensure kernel module 'sctp' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/sctp.conf
    regexp: sctp
    line: install sctp /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_sctp_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required

Disable TIPC Support

Rule ID kernel_module_tipc_disabled

Result

fail

Time 2023-09-07T09:13:08

Severity medium

Identifiers and References

References: CIS§3.4.4, CIS-CSC§11, CIS-CSC§14, CIS-CSC§3, CIS-CSC§9, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS06.06, DISA§CCI-000381, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, OSPP§FMT_SMF_EXT.1, SRG§SRG-OS-000095-GPOS-00049

Description

The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communications between nodes in a cluster. To configure the system to prevent the tipc kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install tipc /bin/true

Rationale

Disabling TIPC protects the system against exploitation of any flaws in its implementation.

Warnings

warning This configuration baseline was created to deploy the base operating system for general purpose workloads. When the operating system is configured for certain purposes, such as a node in High Performance Computing cluster, it is expected that the tipc kernel module will be loaded.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install tipc" /etc/modprobe.d/tipc.conf ; then
	
	sed -i 's#^install tipc.*#install tipc /bin/true#g' /etc/modprobe.d/tipc.conf
else
	echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/tipc.conf
	echo "install tipc /bin/true" >> /etc/modprobe.d/tipc.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: Ensure kernel module 'tipc' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/tipc.conf
    regexp: tipc
    line: install tipc /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_tipc_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required

Deactivate Wireless Network Interfaces

Rule ID	wireless_disable_interfaces
Result	pass
Time	2023-09-07T09:13:08
Severity	medium
Identifiers and References	References: CIS§3.1.2, CIS-CSC§11, CIS-CSC§12, CIS-CSC§14, CIS-CSC§15, CIS-CSC§3, CIS-CSC§8, CIS-CSC§9, COBIT5§APO13.01, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.04, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.05, COBIT5§DSS06.06, CUI§3.1.16, DISA§CCI-000085, DISA§CCI-002418, DISA§CCI-002421, DISA§CCI-001444, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISM§1315, ISM§1319, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, ISO27001-2013§A.9.1.2, NIST§AC-18(a), NIST§AC-18(3), NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST§MP-7, NIST-CSF§PR.AC-3, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, NIST-CSF§PR.PT-4, SRG§SRG-OS-000299-GPOS-00117, SRG§SRG-OS-000300-GPOS-00118, SRG§SRG-OS-000424-GPOS-00188, SRG§SRG-OS-000481-GPOS-000481, STIGID§UBTU-20-010455
Description	Deactivating wireless network interfaces should prevent normal usage of the wireless capability. Verify that there are no wireless interfaces configured on the system with the following command: $ ls -L -d /sys/class/net/*/wireless \| xargs dirname \| xargs basename For each interface, configure the system to disable wireless network interfaces with the following command: $ sudo ifdown `interface name` For each interface listed, find their respective module with the following command: $ basename $(readlink -f /sys/class/net/`interface name`/device/driver) where `interface name` must be substituted by the actual interface name. Create a file in the `/etc/modprobe.d` directory and for each module, add the following line: install `module name` /bin/true For each module from the system, execute the following command to remove it: $ sudo modprobe -r `module name`
Rationale	The use of wireless networking can introduce many different attack vectors into the organization's network. Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to create a denial of service to valid network resources.

Verify Group Who Owns Backup group File

Rule ID	file_groupowner_backup_etc_group
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.8
Description	To properly set the group owner of `/etc/group-`, run the command: $ sudo chgrp root /etc/group-
Rationale	The `/etc/group-` file is a backup file of `/etc/group`, and as such, it contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Verify Group Who Owns Backup gshadow File

Rule ID	file_groupowner_backup_etc_gshadow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.3
Description	To properly set the group owner of `/etc/gshadow-`, run the command: $ sudo chgrp shadow /etc/gshadow-
Rationale	The `/etc/gshadow-` file is a backup of `/etc/gshadow`, and as such, it contains group password hashes. Protection of this file is critical for system security.

Verify Group Who Owns Backup passwd File

Rule ID	file_groupowner_backup_etc_passwd
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.6
Description	To properly set the group owner of `/etc/passwd-`, run the command: $ sudo chgrp root /etc/passwd-
Rationale	The `/etc/passwd-` file is a backup file of `/etc/passwd`, and as such, it contains information about the users that are configured on the system. Protection of this file is critical for system security.

Verify User Who Owns Backup shadow File

Rule ID	file_groupowner_backup_etc_shadow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.7
Description	To properly set the group owner of `/etc/shadow-`, run the command: $ sudo chgrp shadow /etc/shadow-
Rationale	The `/etc/shadow-` file is a backup file of `/etc/shadow`, and as such, it contains the list of local system accounts and password hashes. Protection of this file is critical for system security.

Verify Group Who Owns group File

Rule ID	file_groupowner_etc_group
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.5, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CJIS§5.5.2.2, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, PCIDSS§Req-8.7.c
Description	To properly set the group owner of `/etc/group`, run the command: $ sudo chgrp root /etc/group
Rationale	The `/etc/group` file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Verify Group Who Owns gshadow File

Rule ID	file_groupowner_etc_gshadow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.9, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5
Description	To properly set the group owner of `/etc/gshadow`, run the command: $ sudo chgrp shadow /etc/gshadow
Rationale	The `/etc/gshadow` file contains group password hashes. Protection of this file is critical for system security.

Verify Group Who Owns passwd File

Rule ID	file_groupowner_etc_passwd
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.2, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CJIS§5.5.2.2, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, PCIDSS§Req-8.7.c
Description	To properly set the group owner of `/etc/passwd`, run the command: $ sudo chgrp root /etc/passwd
Rationale	The `/etc/passwd` file contains information about the users that are configured on the system. Protection of this file is critical for system security.

Verify Group Who Owns shadow File

Rule ID	file_groupowner_etc_shadow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.4, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CJIS§5.5.2.2, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, PCIDSS§Req-8.7.c
Description	To properly set the group owner of `/etc/shadow`, run the command: $ sudo chgrp shadow /etc/shadow
Rationale	The `/etc/shadow` file stores password hashes. Protection of this file is critical for system security.

Verify User Who Owns Backup group File

Rule ID	file_owner_backup_etc_group
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.8
Description	To properly set the owner of `/etc/group-`, run the command: $ sudo chown root /etc/group-
Rationale	The `/etc/group-` file is a backup file of `/etc/group`, and as such, it contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Verify User Who Owns Backup gshadow File

Rule ID	file_owner_backup_etc_gshadow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.3
Description	To properly set the owner of `/etc/gshadow-`, run the command: $ sudo chown root /etc/gshadow-
Rationale	The `/etc/gshadow-` file is a backup of `/etc/gshadow`, and as such, it contains group password hashes. Protection of this file is critical for system security.

Verify User Who Owns Backup passwd File

Rule ID	file_owner_backup_etc_passwd
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.6
Description	To properly set the owner of `/etc/passwd-`, run the command: $ sudo chown root /etc/passwd-
Rationale	The `/etc/passwd-` file is a backup file of `/etc/passwd`, and as such, it contains information about the users that are configured on the system. Protection of this file is critical for system security.

Verify Group Who Owns Backup shadow File

Rule ID	file_owner_backup_etc_shadow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.7
Description	To properly set the owner of `/etc/shadow-`, run the command: $ sudo chown root /etc/shadow-
Rationale	The `/etc/shadow-` file is a backup file of `/etc/shadow`, and as such, it contains the list of local system accounts and password hashes. Protection of this file is critical for system security.

Verify User Who Owns group File

Rule ID	file_owner_etc_group
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.5, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CJIS§5.5.2.2, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, PCIDSS§Req-8.7.c
Description	To properly set the owner of `/etc/group`, run the command: $ sudo chown root /etc/group
Rationale	The `/etc/group` file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Verify User Who Owns gshadow File

Rule ID	file_owner_etc_gshadow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R36), CIS§6.1.9, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5
Description	To properly set the owner of `/etc/gshadow`, run the command: $ sudo chown root /etc/gshadow
Rationale	The `/etc/gshadow` file contains group password hashes. Protection of this file is critical for system security.

Verify User Who Owns passwd File

Rule ID	file_owner_etc_passwd
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.2, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CJIS§5.5.2.2, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, PCIDSS§Req-8.7.c
Description	To properly set the owner of `/etc/passwd`, run the command: $ sudo chown root /etc/passwd
Rationale	The `/etc/passwd` file contains information about the users that are configured on the system. Protection of this file is critical for system security.

Verify User Who Owns shadow File

Rule ID	file_owner_etc_shadow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R36), CIS§6.1.4, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CJIS§5.5.2.2, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, PCIDSS§Req-8.7.c
Description	To properly set the owner of `/etc/shadow`, run the command: $ sudo chown root /etc/shadow
Rationale	The `/etc/shadow` file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

Verify Permissions on Backup group File

Rule ID	file_permissions_backup_etc_group
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.8
Description	To properly set the permissions of `/etc/group-`, run the command: $ sudo chmod 0644 /etc/group-
Rationale	The `/etc/group-` file is a backup file of `/etc/group`, and as such, it contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Verify Permissions on Backup gshadow File

Rule ID	file_permissions_backup_etc_gshadow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.3
Description	To properly set the permissions of `/etc/gshadow-`, run the command: $ sudo chmod 0640 /etc/gshadow-
Rationale	The `/etc/gshadow-` file is a backup of `/etc/gshadow`, and as such, it contains group password hashes. Protection of this file is critical for system security.

Verify Permissions on Backup passwd File

Rule ID	file_permissions_backup_etc_passwd
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.6
Description	To properly set the permissions of `/etc/passwd-`, run the command: $ sudo chmod 0644 /etc/passwd-
Rationale	The `/etc/passwd-` file is a backup file of `/etc/passwd`, and as such, it contains information about the users that are configured on the system. Protection of this file is critical for system security.

Verify Permissions on Backup shadow File

Rule ID	file_permissions_backup_etc_shadow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.7
Description	To properly set the permissions of `/etc/shadow-`, run the command: $ sudo chmod 0640 /etc/shadow-
Rationale	The `/etc/shadow-` file is a backup file of `/etc/shadow`, and as such, it contains the list of local system accounts and password hashes. Protection of this file is critical for system security.

Verify Permissions on group File

Rule ID	file_permissions_etc_group
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R36), CIS§6.1.5, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CJIS§5.5.2.2, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, PCIDSS§Req-8.7.c
Description	To properly set the permissions of `/etc/passwd`, run the command: $ sudo chmod 0644 /etc/passwd
Rationale	The `/etc/group` file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Verify Permissions on gshadow File

Rule ID	file_permissions_etc_gshadow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R36), CIS§6.1.9, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5
Description	To properly set the permissions of `/etc/gshadow`, run the command: $ sudo chmod 0640 /etc/gshadow
Rationale	The `/etc/gshadow` file contains group password hashes. Protection of this file is critical for system security.

Verify Permissions on passwd File

Rule ID	file_permissions_etc_passwd
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R36), CIS§6.1.2, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CJIS§5.5.2.2, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, PCIDSS§Req-8.7.c
Description	To properly set the permissions of `/etc/passwd`, run the command: $ sudo chmod 0644 /etc/passwd
Rationale	If the `/etc/passwd` file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security.

Verify Permissions on shadow File

Rule ID	file_permissions_etc_shadow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R36), CIS§6.1.4, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CJIS§5.5.2.2, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, PCIDSS§Req-8.7.c
Description	To properly set the permissions of `/etc/shadow`, run the command: $ sudo chmod 0640 /etc/shadow
Rationale	The `/etc/shadow` file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

Verify that All World-Writable Directories Have Sticky Bits Set

Rule ID	dir_perms_world_writable_sticky_bits
Result	pass
Time	2023-09-07T09:13:11
Severity	medium
Identifiers and References	References: ANSSI§BP28(R40), CIS§1.1.22, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, DISA§CCI-001090, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000138-GPOS-00069, STIGID§UBTU-20-010411
Description	When the so-called 'sticky bit' is set on a directory, only the owner of a given file may remove that file from the directory. Without the sticky bit, any user with write access to a directory may remove any file in the directory. Setting the sticky bit prevents users from removing each other's files. In cases where there is no reason for a directory to be world-writable, a better solution is to remove that permission rather than to set the sticky bit. However, if a directory is used by a particular application, consult that application's documentation instead of blindly changing modes. To set the sticky bit on a world-writable directory DIR, run the following command: $ sudo chmod +t DIR
Rationale	Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure. The only authorized public directories are those temporary directories supplied with the system, or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system, by users for temporary file storage (such as `/tmp`), and for directories requiring global read/write access.

Ensure No World-Writable Files Exist

Rule ID	file_permissions_unauthorized_world_writable
Result	pass
Time	2023-09-07T09:13:23
Severity	medium
Identifiers and References	References: ANSSI§BP28(R40), CIS§6.1.10, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5
Description	It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured application or user account. Finally, this applies to real files and not virtual files that are a part of pseudo file systems such as `sysfs` or `procfs`.
Rationale	Data in world-writable files can be modified by any user on the system. In almost all circumstances, files can be configured using a combination of user and group permissions to support whatever legitimate access is needed without the risk caused by world-writable files.

Ensure All Files Are Owned by a User

Rule ID	no_files_unowned_by_user
Result	pass
Time	2023-09-07T09:13:37
Severity	medium
Identifiers and References	References: CIS§6.1.11, CIS-CSC§11, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CIS-CSC§9, COBIT5§APO01.06, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.02, COBIT5§DSS06.03, COBIT5§DSS06.06, DISA§CCI-000366, DISA§CCI-002165, ISA-62443-2009§4.3.3.2.2, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 7.6, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.1, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.AC-6, NIST-CSF§PR.DS-5, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, SRG§SRG-OS-000480-GPOS-00227
Description	If any files are not owned by a user, then the cause of their lack of ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate user. The following command will discover and print any files on local partitions which do not belong to a valid user: $ df --local -P \| awk {'if (NR!=1) print $6'} \| sudo xargs -I '{}' find '{}' -xdev -nouser To search all filesystems on a system including network mounted filesystems the following command can be run manually for each partition: $ sudo find PARTITION -xdev -nouser
Rationale	Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed.
Warnings	warning For this rule to evaluate centralized user accounts, `getent` must be working properly so that running the command getent passwd returns a list of all users in your organization. If using the System Security Services Daemon (SSSD), enumerate = true must be configured in your organization's domain to return a complete list of users warning Enabling this rule will result in slower scan times depending on the size of your organization and number of centralized users.

Ensure no ungrouped files or directories exist

Rule ID	no_ungrouped_files_or_dirs
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§6.1.12
Description	Sometimes when administrators delete users or groups from the system they neglect to remove all files owned by those users or groups. A new user who is assigned the deleted user's user ID or group ID may then end up "owning" these files, and thus have more access on the system than was intended.
Rationale	A new user who is assigned the deleted user's user ID or group ID may then end up "owning" these files, and thus have more access on the system than was intended.

Disable the Automounter

Rule ID	service_autofs_disabled
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§1.1.23, CIS-CSC§1, CIS-CSC§12, CIS-CSC§15, CIS-CSC§16, CIS-CSC§5, COBIT5§APO13.01, COBIT5§DSS01.04, COBIT5§DSS05.03, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS05.10, COBIT5§DSS06.03, COBIT5§DSS06.10, CUI§3.4.6, DISA§CCI-000366, DISA§CCI-000778, DISA§CCI-001958, HIPAA§164.308(a)(3)(i), HIPAA§164.308(a)(3)(ii)(A), HIPAA§164.310(d)(1), HIPAA§164.310(d)(2), HIPAA§164.312(a)(1), HIPAA§164.312(a)(2)(iv), HIPAA§164.312(b), ISA-62443-2009§4.3.3.2.2, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.4, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.18.1.4, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.9.2.1, ISO27001-2013§A.9.2.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.2.4, ISO27001-2013§A.9.2.6, ISO27001-2013§A.9.3.1, ISO27001-2013§A.9.4.2, ISO27001-2013§A.9.4.3, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST§MP-7, NIST-CSF§PR.AC-1, NIST-CSF§PR.AC-3, NIST-CSF§PR.AC-6, NIST-CSF§PR.AC-7, SRG§SRG-OS-000114-GPOS-00059, SRG§SRG-OS-000378-GPOS-00163, SRG§SRG-OS-000480-GPOS-00227
Description	The `autofs` daemon mounts and unmounts filesystems, such as user home directories shared via NFS, on demand. In addition, autofs can be used to handle removable media, and the default configuration provides the cdrom device as `/misc/cd`. However, this method of providing access to removable media is not common, so autofs can almost always be disabled if NFS is not in use. Even if NFS is required, it may be possible to configure filesystem mounts statically by editing `/etc/fstab` rather than relying on the automounter. The `autofs` service can be disabled with the following command: $ sudo systemctl mask --now autofs.service
Rationale	Disabling the automounter permits the administrator to statically control filesystem mounting through `/etc/fstab`. Additionally, automatically mounting filesystems permits easy introduction of unknown devices, thereby facilitating malicious activity.

Disable Mounting of cramfs

Rule ID kernel_module_cramfs_disabled

Result

fail

Time 2023-09-07T09:13:40

Severity low

Identifiers and References

Description

To configure the system to prevent the cramfs kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install cramfs /bin/true

This effectively prevents usage of this uncommon filesystem. The cramfs filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A cramfs image can be used without having to first decompress the image.

Rationale

Removing support for unneeded filesystem types reduces the local attack surface of the server.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install cramfs" /etc/modprobe.d/cramfs.conf ; then
	
	sed -i 's#^install cramfs.*#install cramfs /bin/true#g' /etc/modprobe.d/cramfs.conf
else
	echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/cramfs.conf
	echo "install cramfs /bin/true" >> /etc/modprobe.d/cramfs.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: Ensure kernel module 'cramfs' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/cramfs.conf
    regexp: cramfs
    line: install cramfs /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_cramfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required

Disable Mounting of freevxfs

Rule ID kernel_module_freevxfs_disabled

Result

fail

Time 2023-09-07T09:13:40

Severity low

Identifiers and References

Description

To configure the system to prevent the freevxfs kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install freevxfs /bin/true

This effectively prevents usage of this uncommon filesystem.

Rationale

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install freevxfs" /etc/modprobe.d/freevxfs.conf ; then
	
	sed -i 's#^install freevxfs.*#install freevxfs /bin/true#g' /etc/modprobe.d/freevxfs.conf
else
	echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/freevxfs.conf
	echo "install freevxfs /bin/true" >> /etc/modprobe.d/freevxfs.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: Ensure kernel module 'freevxfs' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/freevxfs.conf
    regexp: freevxfs
    line: install freevxfs /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_freevxfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required

Disable Mounting of hfs

Rule ID kernel_module_hfs_disabled

Result

fail

Time 2023-09-07T09:13:40

Severity low

Identifiers and References

Description

To configure the system to prevent the hfs kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install hfs /bin/true

This effectively prevents usage of this uncommon filesystem.

Rationale

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install hfs" /etc/modprobe.d/hfs.conf ; then
	
	sed -i 's#^install hfs.*#install hfs /bin/true#g' /etc/modprobe.d/hfs.conf
else
	echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/hfs.conf
	echo "install hfs /bin/true" >> /etc/modprobe.d/hfs.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: Ensure kernel module 'hfs' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/hfs.conf
    regexp: hfs
    line: install hfs /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_hfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required

Disable Mounting of hfsplus

Rule ID kernel_module_hfsplus_disabled

Result

fail

Time 2023-09-07T09:13:40

Severity low

Identifiers and References

Description

To configure the system to prevent the hfsplus kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install hfsplus /bin/true

This effectively prevents usage of this uncommon filesystem.

Rationale

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install hfsplus" /etc/modprobe.d/hfsplus.conf ; then
	
	sed -i 's#^install hfsplus.*#install hfsplus /bin/true#g' /etc/modprobe.d/hfsplus.conf
else
	echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/hfsplus.conf
	echo "install hfsplus /bin/true" >> /etc/modprobe.d/hfsplus.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: Ensure kernel module 'hfsplus' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/hfsplus.conf
    regexp: hfsplus
    line: install hfsplus /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_hfsplus_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required

Disable Mounting of jffs2

Rule ID kernel_module_jffs2_disabled

Result

fail

Time 2023-09-07T09:13:40

Severity low

Identifiers and References

Description

To configure the system to prevent the jffs2 kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install jffs2 /bin/true

This effectively prevents usage of this uncommon filesystem.

Rationale

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install jffs2" /etc/modprobe.d/jffs2.conf ; then
	
	sed -i 's#^install jffs2.*#install jffs2 /bin/true#g' /etc/modprobe.d/jffs2.conf
else
	echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/jffs2.conf
	echo "install jffs2 /bin/true" >> /etc/modprobe.d/jffs2.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: Ensure kernel module 'jffs2' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/jffs2.conf
    regexp: jffs2
    line: install jffs2 /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_jffs2_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required

Disable Mounting of udf

Rule ID kernel_module_udf_disabled

Result

fail

Time 2023-09-07T09:13:40

Severity low

Identifiers and References

Description

To configure the system to prevent the udf kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install udf /bin/true

This effectively prevents usage of this uncommon filesystem. The udf filesystem type is the universal disk format used to implement the ISO/IEC 13346 and ECMA-167 specifications. This is an open vendor filesystem type for data storage on a broad range of media. This filesystem type is neccessary to support writing DVDs and newer optical disc formats.

Rationale

Removing support for unneeded filesystem types reduces the local attack surface of the system.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install udf" /etc/modprobe.d/udf.conf ; then
	
	sed -i 's#^install udf.*#install udf /bin/true#g' /etc/modprobe.d/udf.conf
else
	echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/udf.conf
	echo "install udf /bin/true" >> /etc/modprobe.d/udf.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: Ensure kernel module 'udf' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/udf.conf
    regexp: udf
    line: install udf /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_udf_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required

Disable Modprobe Loading of USB Storage Driver

Rule ID kernel_module_usb-storage_disabled

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

To prevent USB storage devices from being used, configure the kernel module loading system to prevent automatic loading of the USB storage driver. To configure the system to prevent the usb-storage kernel module from being loaded, add the following line to a file in the directory /etc/modprobe.d:

install usb-storage /bin/true

This will prevent the modprobe program from loading the usb-storage module, but will not prevent an administrator (or another program) from using the insmod program to load the module manually.

Rationale

USB storage devices such as thumb drives can be used to introduce malicious software.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC_ALL=C grep -q -m 1 "^install usb-storage" /etc/modprobe.d/usb-storage.conf ; then
	
	sed -i 's#^install usb-storage.*#install usb-storage /bin/true#g' /etc/modprobe.d/usb-storage.conf
else
	echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/usb-storage.conf
	echo "install usb-storage /bin/true" >> /etc/modprobe.d/usb-storage.conf
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: Ensure kernel module 'usb-storage' is disabled
  lineinfile:
    create: true
    dest: /etc/modprobe.d/usb-storage.conf
    regexp: usb-storage
    line: install usb-storage /bin/true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.21
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - kernel_module_usb-storage_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required

Add nodev Option to /dev/shm

Rule ID	mount_option_dev_shm_nodev
Result	pass
Time	2023-09-07T09:13:40
Severity	low
Identifiers and References	References: CIS§1.1.7, CIS-CSC§11, CIS-CSC§13, CIS-CSC§14, CIS-CSC§3, CIS-CSC§8, CIS-CSC§9, COBIT5§APO13.01, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS05.06, COBIT5§DSS06.06, DISA§CCI-001764, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.9, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.8.2.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.8.3.1, ISO27001-2013§A.8.3.3, ISO27001-2013§A.9.1.2, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST§AC-6, NIST§AC-6(1), NIST§MP-7, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-2, NIST-CSF§PR.PT-3, SRG§SRG-OS-000368-GPOS-00154
Description	The `nodev` mount option can be used to prevent creation of device files in `/dev/shm`. Legitimate character and block devices should not exist within temporary directories like `/dev/shm`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.
Rationale	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

Add noexec Option to /dev/shm

Rule ID mount_option_dev_shm_noexec

Result

fail

Time 2023-09-07T09:13:40

Severity low

Identifiers and References

Description

The noexec mount option can be used to prevent binaries from being executed out of /dev/shm. It can be dangerous to allow the execution of binaries from world-writable temporary storage directories such as /dev/shm. Add the noexec option to the fourth column of /etc/fstab for the line which controls mounting of /dev/shm.

Rationale

Allowing users to execute binaries from world-writable directories such as /dev/shm can expose the system to potential compromise.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

function include_mount_options_functions {
	:
}

# $1: type of filesystem
# $2: new mount point option
# $3: filesystem of new mount point (used when adding new entry in fstab)
# $4: mount type of new mount point (used when adding new entry in fstab)
function ensure_mount_option_for_vfstype {
        local _vfstype="$1" _new_opt="$2" _filesystem=$3 _type=$4 _vfstype_points=()
        readarray -t _vfstype_points < <(grep -E "[[:space:]]${_vfstype}[[:space:]]" /etc/fstab | awk '{print $2}')

        for _vfstype_point in "${_vfstype_points[@]}"
        do
                ensure_mount_option_in_fstab "$_vfstype_point" "$_new_opt" "$_filesystem" "$_type"
        done
}

# $1: mount point
# $2: new mount point option
# $3: device or virtual string (used when adding new entry in fstab)
# $4: mount type of mount point (used when adding new entry in fstab)
function ensure_mount_option_in_fstab {
	local _mount_point="$1" _new_opt="$2" _device=$3 _type=$4
	local _mount_point_match_regexp="" _previous_mount_opts=""
	_mount_point_match_regexp="$(get_mount_point_regexp "$_mount_point")"

	if [ "$(grep -c "$_mount_point_match_regexp" /etc/fstab)" -eq 0 ]; then
		# runtime opts without some automatic kernel/userspace-added defaults
		_previous_mount_opts=$(grep "$_mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
					| sed -E "s/(rw|defaults|seclabel|${_new_opt})(,|$)//g;s/,$//")
		[ "$_previous_mount_opts" ] && _previous_mount_opts+=","
		echo "${_device} ${_mount_point} ${_type} defaults,${_previous_mount_opts}${_new_opt} 0 0" >> /etc/fstab
	elif [ "$(grep "$_mount_point_match_regexp" /etc/fstab | grep -c "$_new_opt")" -eq 0 ]; then
		_previous_mount_opts=$(grep "$_mount_point_match_regexp" /etc/fstab | awk '{print $4}')
		sed -i "s|\(${_mount_point_match_regexp}.*${_previous_mount_opts}\)|\1,${_new_opt}|" /etc/fstab
	fi
}

# $1: mount point
function get_mount_point_regexp {
		printf "[[:space:]]%s[[:space:]]" "$1"
}

# $1: mount point
function assert_mount_point_in_fstab {
	local _mount_point_match_regexp
	_mount_point_match_regexp="$(get_mount_point_regexp "$1")"
	grep "$_mount_point_match_regexp" -q /etc/fstab \
		|| { echo "The mount point '$1' is not even in /etc/fstab, so we can't set up mount options" >&2; return 1; }
}

# $1: mount point
function remove_defaults_from_fstab_if_overriden {
	local _mount_point_match_regexp
	_mount_point_match_regexp="$(get_mount_point_regexp "$1")"
	if grep "$_mount_point_match_regexp" /etc/fstab | grep -q "defaults,"
	then
		sed -i "s|\(${_mount_point_match_regexp}.*\)defaults,|\1|" /etc/fstab
	fi
}

# $1: mount point
function ensure_partition_is_mounted {
	local _mount_point="$1"
	mkdir -p "$_mount_point" || return 1
	if mountpoint -q "$_mount_point"; then
		mount -o remount --target "$_mount_point"
	else
		mount --target "$_mount_point"
	fi
}
include_mount_options_functions

function perform_remediation {
	# test "$mount_has_to_exist" != 'no'
	if test "no" != 'no'; then
		assert_mount_point_in_fstab /dev/shm || { echo "Not remediating, because there is no record of /dev/shm in /etc/fstab" >&2; return 1; }
	fi

	ensure_mount_option_in_fstab "/dev/shm" "noexec" "tmpfs" "tmpfs"

	ensure_partition_is_mounted "/dev/shm"
}

perform_remediation

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	high
Strategy:	configure

- name: Check information associated to mountpoint
  command: findmnt  '/dev/shm'
  register: device_name
  failed_when: device_name.rc > 1
  changed_when: false
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

- name: Create mount_info dictionary variable
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - '{{ device_name.stdout_lines[0].split() | list | lower }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length > 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

- name: If /dev/shm not mounted, craft mount_info manually
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
    - - target
      - source
      - fstype
      - options
    - - /dev/shm
      - tmpfs
      - tmpfs
      - defaults
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ("" | length == 0)
    - (device_name.stdout | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

- name: Make sure noexec option is part of the to /dev/shm options
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - mount_info is defined and "noexec" not in mount_info.options
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

- name: Ensure /dev/shm is mounted with noexec option
  mount:
    path: /dev/shm
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (device_name.stdout is defined and (device_name.stdout | length > 0)) or (""
      | length == 0)
  tags:
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - low_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

Add nosuid Option to /dev/shm

Rule ID	mount_option_dev_shm_nosuid
Result	pass
Time	2023-09-07T09:13:40
Severity	low
Identifiers and References	References: CIS§1.1.8, CIS-CSC§11, CIS-CSC§13, CIS-CSC§14, CIS-CSC§3, CIS-CSC§8, CIS-CSC§9, COBIT5§APO13.01, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS05.06, COBIT5§DSS06.06, DISA§CCI-001764, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.9, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.8.2.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.8.3.1, ISO27001-2013§A.8.3.3, ISO27001-2013§A.9.1.2, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST§AC-6, NIST§AC-6(1), NIST§MP-7, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-2, NIST-CSF§PR.PT-3, SRG§SRG-OS-000368-GPOS-00154
Description	The `nosuid` mount option can be used to prevent execution of setuid programs in `/dev/shm`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/dev/shm`.
Rationale	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.

Add nodev Option to /home if it exists

Rule ID	mount_option_home_nodev_optional
Result	pass
Time	2023-09-07T09:13:40
Severity	unknown
Identifiers and References	References: ANSSI§BP28(R12), CIS§1.1.18, SRG§SRG-OS-000368-GPOS-00154
Description	The `nodev` mount option can be used to prevent device files from being created in `/home`. Legitimate character and block devices should exist only in the `/dev` directory on the root partition or within chroot jails built for system services. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/home`.
Rationale	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

Add nodev Option to /tmp if it exists

Rule ID	mount_option_tmp_nodev_optional
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R12), CIS§1.1.3, CIS-CSC§11, CIS-CSC§13, CIS-CSC§14, CIS-CSC§3, CIS-CSC§8, CIS-CSC§9, COBIT5§APO13.01, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS05.06, COBIT5§DSS06.06, DISA§CCI-001764, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.9, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.8.2.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.8.3.1, ISO27001-2013§A.8.3.3, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST§AC-6, NIST§AC-6(1), NIST§MP-7, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-2, NIST-CSF§PR.PT-3, SRG§SRG-OS-000368-GPOS-00154
Description	The `nodev` mount option can be used to prevent device files from being created in `/tmp`. Legitimate character and block devices should not exist within temporary directories like `/tmp`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.
Rationale	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

Add noexec Option to /tmp if it exists

Rule ID	mount_option_tmp_noexec_optional
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R12), CIS§1.1.5, CIS-CSC§11, CIS-CSC§13, CIS-CSC§14, CIS-CSC§3, CIS-CSC§8, CIS-CSC§9, COBIT5§APO13.01, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS05.06, COBIT5§DSS06.06, DISA§CCI-001764, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.9, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.8.2.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.8.3.1, ISO27001-2013§A.8.3.3, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST§AC-6, NIST§AC-6(1), NIST§MP-7, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-2, NIST-CSF§PR.PT-3, SRG§SRG-OS-000368-GPOS-00154
Description	The `noexec` mount option can be used to prevent binaries from being executed out of `/tmp`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.
Rationale	Allowing users to execute binaries from world-writable directories such as `/tmp` should never be necessary in normal operation and can expose the system to potential compromise.

Add nosuid Option to /tmp if it exists

Rule ID	mount_option_tmp_nosuid_optional
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R12), CIS§1.1.4, CIS-CSC§11, CIS-CSC§13, CIS-CSC§14, CIS-CSC§3, CIS-CSC§8, CIS-CSC§9, COBIT5§APO13.01, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS05.06, COBIT5§DSS06.06, DISA§CCI-001764, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.9, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.8.2.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.8.3.1, ISO27001-2013§A.8.3.3, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST§AC-6, NIST§AC-6(1), NIST§MP-7, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-2, NIST-CSF§PR.PT-3, SRG§SRG-OS-000368-GPOS-00154
Description	The `nosuid` mount option can be used to prevent execution of setuid programs in `/tmp`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/tmp`.
Rationale	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.

Add nodev Option to /var/tmp if it exists

Rule ID	mount_option_var_tmp_nodev_optional
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R12), CIS§1.1.12, DISA§CCI-001764, SRG§SRG-OS-000368-GPOS-00154
Description	The `nodev` mount option can be used to prevent device files from being created in `/var/tmp`. Legitimate character and block devices should not exist within temporary directories like `/var/tmp`. Add the `nodev` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`.
Rationale	The only legitimate location for device files is the `/dev` directory located on the root partition. The only exception to this is chroot jails.

Add noexec Option to /var/tmp if it exists

Rule ID	mount_option_var_tmp_noexec_optional
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R12), CIS§1.1.14, DISA§CCI-001764, SRG§SRG-OS-000368-GPOS-00154
Description	The `noexec` mount option can be used to prevent binaries from being executed out of `/var/tmp`. Add the `noexec` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`.
Rationale	Allowing users to execute binaries from world-writable directories such as `/var/tmp` should never be necessary in normal operation and can expose the system to potential compromise.

Add nosuid Option to /var/tmp if it exists

Rule ID	mount_option_var_tmp_nosuid_optional
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R12), CIS§1.1.13, DISA§CCI-001764, SRG§SRG-OS-000368-GPOS-00154
Description	The `nosuid` mount option can be used to prevent execution of setuid programs in `/var/tmp`. The SUID and SGID permissions should not be required in these world-writable directories. Add the `nosuid` option to the fourth column of `/etc/fstab` for the line which controls mounting of `/var/tmp`.
Rationale	The presence of SUID and SGID executables should be tightly controlled. Users should not be able to execute SUID or SGID binaries from temporary storage partitions.

Disable Core Dumps for All Users

Rule ID disable_users_coredumps

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

References: CIS§1.6.4, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§15, CIS-CSC§16, CIS-CSC§2, CIS-CSC§7, CIS-CSC§8, COBIT5§APO13.01, COBIT5§BAI04.04, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.07, DISA§CCI-000366, ISA-62443-2013§SR 6.2, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.2, ISO27001-2013§A.12.1.3, ISO27001-2013§A.17.2.1, NIST-CSF§DE.CM-1, NIST-CSF§PR.DS-4, SRG§SRG-OS-000480-GPOS-00227

Description

To disable core dumps for all users, add the following line to /etc/security/limits.conf, or to a file within the /etc/security/limits.d/ directory:

*     hard   core    0

Rationale

A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'libpam-runtime' 2>/dev/null | grep -q installed; then

SECURITY_LIMITS_FILE="/etc/security/limits.conf"

if grep -qE '\*\s+hard\s+core' $SECURITY_LIMITS_FILE; then
        sed -ri 's/(hard\s+core\s+)[[:digit:]]+/\1 0/' $SECURITY_LIMITS_FILE
else
        echo "*     hard   core    0" >> $SECURITY_LIMITS_FILE
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: disable core dumps with limits
  lineinfile:
    dest: /etc/security/limits.conf
    regexp: ^[^#].*core
    line: '*        hard       core      0'
    create: true
  when: '"libpam-runtime" in ansible_facts.packages'
  tags:
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

Disable Core Dumps for SUID programs

Rule ID sysctl_fs_suid_dumpable

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

References: ANSSI§BP28(R23), CIS§1.6.4, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3), HIPAA§164.308(a)(4), HIPAA§164.310(b), HIPAA§164.310(c), HIPAA§164.312(a), HIPAA§164.312(e), NIST§SI-11(a), NIST§SI-11(b)

Description

To set the runtime status of the fs.suid_dumpable kernel parameter, run the following command:

$ sudo sysctl -w fs.suid_dumpable=0

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

fs.suid_dumpable = 0

Rationale

The core dump of a setuid program is more likely to contain sensitive data, as the program itself runs with greater privileges than the user who initiated execution of the program. Disabling the ability for any setuid program to write a core file decreases the risk of unauthorized access of such data.

Remediation Shell script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then



#
# Set runtime for fs.suid_dumpable
#
/sbin/sysctl -q -n -w fs.suid_dumpable="0"

#
# If fs.suid_dumpable present in /etc/sysctl.conf, change value to "0"
#	else, add "fs.suid_dumpable = 0" to /etc/sysctl.conf
#
# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/sysctl.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^fs.suid_dumpable")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^fs.suid_dumpable\\>" "/etc/sysctl.conf"; then
    "${sed_command[@]}" "s/^fs.suid_dumpable\\>.*/$formatted_output/gi" "/etc/sysctl.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/sysctl.conf" >> "/etc/sysctl.conf"
    printf '%s\n' "$formatted_output" >> "/etc/sysctl.conf"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

- name: Ensure sysctl fs.suid_dumpable is set to 0
  sysctl:
    name: fs.suid_dumpable
    value: '0'
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_suid_dumpable

Enable Randomized Layout of Virtual Address Space

Rule ID	sysctl_kernel_randomize_va_space
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R23), CIS§1.6.2, CUI§3.1.7, DISA§CCI-000366, DISA§CCI-002824, HIPAA§164.308(a)(1)(ii)(D), HIPAA§164.308(a)(3), HIPAA§164.308(a)(4), HIPAA§164.310(b), HIPAA§164.310(c), HIPAA§164.312(a), HIPAA§164.312(e), NERC-CIP§CIP-002-3 R1.1, NERC-CIP§CIP-002-3 R1.2, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 4.1, NERC-CIP§CIP-004-3 4.2, NERC-CIP§CIP-004-3 R2.2.3, NERC-CIP§CIP-004-3 R2.2.4, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-004-3 R4, NERC-CIP§CIP-005-3a R1, NERC-CIP§CIP-005-3a R1.1, NERC-CIP§CIP-005-3a R1.2, NERC-CIP§CIP-007-3 R3, NERC-CIP§CIP-007-3 R3.1, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.2, NERC-CIP§CIP-007-3 R5.1.3, NERC-CIP§CIP-007-3 R5.2.1, NERC-CIP§CIP-007-3 R5.2.3, NERC-CIP§CIP-007-3 R8.4, NERC-CIP§CIP-009-3 R.1.1, NERC-CIP§CIP-009-3 R4, NIST§SC-30, NIST§SC-30(2), NIST§CM-6(a), SRG§SRG-OS-000433-GPOS-00193, SRG§SRG-OS-000480-GPOS-00227, STIGID§UBTU-20-010448
Description	To set the runtime status of the `kernel.randomize_va_space` kernel parameter, run the following command: $ sudo sysctl -w kernel.randomize_va_space=2 To make sure that the setting is persistent, add the following line to a file in the directory `/etc/sysctl.d`: kernel.randomize_va_space = 2
Rationale	Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code they have introduced into a process's address space during an attempt at exploitation. Additionally, ASLR makes it more difficult for an attacker to know the location of existing code in order to re-purpose it using return oriented programming (ROP) techniques.

Ensure XD/NX support is enabled

Rule ID	ensure_xd_nx_support_enabled
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§1.6.1, DISA§CCI-002824, SRG§SRG-OS-000433-GPOS-00192, STIGID§UBTU-20-010447
Description	Recent processors in the x86 family support the ability to prevent code execution on a per memory page basis. Generically and on AMD processors, this ability is called No Execute (NX), while on Intel processors it is called Execute Disable (XD). This ability can help prevent exploitation of buffer overflow vulnerabilities and should be activated whenever possible. Extra steps must be taken to ensure that this protection is enabled, particularly on 32-bit x86 systems. Other processors, such as Itanium and POWER, have included such support since inception and the standard kernel for those platforms supports the feature. Note: Ensure your system supports the XD or NX bit and has PAE support before implementing this recommendation as this may prevent it from booting if these are not supported by your hardware.
Rationale	Enabling any feature that can protect against buffer overflow attacks enhances the security of the system.

Disable Apport Service

Rule ID service_apport_disabled

Result

fail

Time 2023-09-07T09:13:40

Severity unknown

Identifiers and References

Description

The Apport modifies certain kernel configuration values at runtime which may decrease the overall security of the system and expose sensitive data. The apport service can be disabled with the following command:

$ sudo systemctl mask --now apport.service

Rationale

The Apport service modifies the kernel fs.suid_dumpable configuration at runtime which prevents other hardening from being persistent. Disabling the service prevents this behavior.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	disable



SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'apport.service'
"$SYSTEMCTL_EXEC" disable 'apport.service'
"$SYSTEMCTL_EXEC" mask 'apport.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^apport.socket'; then
    "$SYSTEMCTL_EXEC" stop 'apport.socket'
    "$SYSTEMCTL_EXEC" mask 'apport.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'apport.service' || true

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	disable

- name: Disable service apport
  block:

    - name: Gather the service facts
      service_facts: null

    - name: Disable service apport
      systemd:
        name: apport.service
        enabled: 'no'
        state: stopped
        masked: 'yes'
      when: '"apport.service" in ansible_facts.services'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_apport_disabled
    - unknown_severity

- name: Unit Socket Exists - apport.socket
  command: systemctl list-unit-files apport.socket
  args:
    warn: false
  register: socket_file_exists
  changed_when: false
  ignore_errors: true
  check_mode: false
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_apport_disabled
    - unknown_severity

- name: Disable socket apport
  systemd:
    name: apport.socket
    enabled: 'no'
    state: stopped
    masked: 'yes'
  when: '"apport.socket" in socket_file_exists.stdout_lines[1]'
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_apport_disabled
    - unknown_severity

Remediation Puppet snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

include disable_apport

class disable_apport {
  service {'apport':
    enable => false,
    ensure => 'stopped',
  }
}

Remediation script: (show)

Complexity:	low
Disruption:	medium
Reboot:	true
Strategy:	disable

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: apport.service
        enabled: false
        mask: true
      - name: apport.socket
        enabled: false
        mask: true

Uninstall avahi-daemon Package

Rule ID	package_avahi-daemon_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	low
Identifiers and References	References: CIS§2.2.3
Description	The `avahi-daemon` package can be removed with the following command: $ apt-get remove avahi-daemon
Rationale	Automatic discovery of network services is not normally required for system functionality. It is recommended to remove this package to reduce the potential attack surface.

Disable Avahi Server Software

Rule ID	service_avahi-daemon_disabled
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§2.2.3, CIS-CSC§11, CIS-CSC§14, CIS-CSC§3, CIS-CSC§9, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS06.06, DISA§CCI-000366, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3
Description	The `avahi-daemon` service can be disabled with the following command: $ sudo systemctl mask --now avahi-daemon.service
Rationale	Because the Avahi daemon service keeps an open network port, it is subject to network attacks. Its functionality is convenient but is only appropriate if the local network can be trusted.

Verify Group Who Owns /etc/at.allow file

Rule ID	file_groupowner_at_allow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.9
Description	If `/etc/at.allow` exists, it must be group-owned by `root`. To properly set the group owner of `/etc/at.allow`, run the command: $ sudo chgrp root /etc/at.allow
Rationale	If the owner of the at.allow file is not set to root, the possibility exists for an unauthorized user to view or edit sensitive information.

Verify Group Who Owns /etc/cron.allow file

Rule ID	file_groupowner_cron_allow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.8, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, DISA§CCI-000366, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	If `/etc/cron.allow` exists, it must be group-owned by `root`. To properly set the group owner of `/etc/cron.allow`, run the command: $ sudo chgrp root /etc/cron.allow
Rationale	If the owner of the cron.allow file is not set to root, the possibility exists for an unauthorized user to view or edit sensitive information.

Verify User Who Owns /etc/at.allow file

Rule ID	file_owner_at_allow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.9
Description	If `/etc/at.allow` exists, it must be owned by `root`. To properly set the owner of `/etc/at.allow`, run the command: $ sudo chown root /etc/at.allow
Rationale	If the owner of the at.allow file is not set to root, the possibility exists for an unauthorized user to view or edit sensitive information.

Verify User Who Owns /etc/cron.allow file

Rule ID	file_owner_cron_allow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.8, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, DISA§CCI-000366, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	If `/etc/cron.allow` exists, it must be owned by `root`. To properly set the owner of `/etc/cron.allow`, run the command: $ sudo chown root /etc/cron.allow
Rationale	If the owner of the cron.allow file is not set to root, the possibility exists for an unauthorized user to view or edit sensitive information.

Verify Permissions on /etc/at.allow file

Rule ID	file_permissions_at_allow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.9
Description	If `/etc/at.allow` exists, it must have permissions `0640` or more restrictive. To properly set the permissions of `/etc/at.allow`, run the command: $ sudo chmod 0640 /etc/at.allow
Rationale	If the permissions of the at.allow file are not set to 0640 or more restrictive, the possibility exists for an unauthorized user to view or edit sensitive information.

Verify Permissions on /etc/cron.allow file

Rule ID	file_permissions_cron_allow
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.8
Description	If `/etc/cron.allow` exists, it must have permissions `0640` or more restrictive. To properly set the permissions of `/etc/cron.allow`, run the command: $ sudo chmod 0640 /etc/cron.allow
Rationale	If the permissions of the cron.allow file are not set to 0640 or more restrictive, the possibility exists for an unauthorized user to view or edit sensitive information.

Ensure at is restricted to authorized users

Rule ID	restrict_at_users
Result	fail
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.9
Description	Configure /etc/at.allow to allow specific users to use these services. If /etc/at.allow do not exist, then /etc/at.deny is checked. Any user not specifically defined in these file is allowed to use at. By removing the file, only users in /etc/at.allow is allowed to use at. Note: Other methods, such as systemd timers , exist for scheduling jobs. If another method is used, at should be removed, and the alternate method should be secured in accordance with local site policy.
Rationale	On many systems, only the system administrator is authorized to schedule at jobs. Using the at.allow file to control who can run at jobs enforces this policy. It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.
Remediation Shell script: (show) `# Remediation is applicable only in certain platforms if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then rm -rf /etc/at.deny touch /etc/at.allow chmod 640 /etc/at.allow else >&2 echo 'Remediation is not applicable, nothing was done' fi`

Ensure cron is restricted to authorized users

Rule ID	restrict_cron_users
Result	fail
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.8
Description	Configure /etc/cron.allow to allow specific users to use these services. If /etc/cron.allow do not exist, then /etc/cron.deny is checked. Any user not specifically defined in these file is allowed to use cron. By removing the file, only users in /etc/cron.allow is allowed to use cron. Notes: - Other methods, such as systemd timers, exist for scheduling jobs. If another method is used, cron should be removed, and the alternate method should be secured in accordance with local site policy. - Even though a given user is not listed in cron.allow, cron jobs can still be run as that user. - The cron.allow file only controls administrative access to the crontab command for scheduling and modifying cron jobs.
Rationale	On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.
Remediation Shell script: (show) `# Remediation is applicable only in certain platforms if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then rm -rf /etc/cron.deny touch /etc/cron.allow chmod 640 /etc/cron.allow else >&2 echo 'Remediation is not applicable, nothing was done' fi`

Enable cron Service

Rule ID	service_cron_enabled
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.1, CIS-CSC§11, CIS-CSC§14, CIS-CSC§3, CIS-CSC§9, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS06.06, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.9.1.2, NIST§CM-6(a), NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3
Description	The `crond` service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary maintenance tasks, such as notifying root of system activity. The `cron` service can be enabled with the following command: $ sudo systemctl enable cron.service
Rationale	Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential.

Verify Group Who Owns cron.d

Rule ID	file_groupowner_cron_d
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.7, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the group owner of `/etc/cron.d`, run the command: $ sudo chgrp root /etc/cron.d
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.

Verify Group Who Owns cron.daily

Rule ID	file_groupowner_cron_daily
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.4, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the group owner of `/etc/cron.daily`, run the command: $ sudo chgrp root /etc/cron.daily
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.

Verify Group Who Owns cron.hourly

Rule ID	file_groupowner_cron_hourly
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.3, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the group owner of `/etc/cron.hourly`, run the command: $ sudo chgrp root /etc/cron.hourly
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.

Verify Group Who Owns cron.monthly

Rule ID	file_groupowner_cron_monthly
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.6, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the group owner of `/etc/cron.monthly`, run the command: $ sudo chgrp root /etc/cron.monthly
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.

Verify Group Who Owns cron.weekly

Rule ID	file_groupowner_cron_weekly
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.5, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the group owner of `/etc/cron.weekly`, run the command: $ sudo chgrp root /etc/cron.weekly
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.

Verify Group Who Owns Crontab

Rule ID	file_groupowner_crontab
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.2, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the group owner of `/etc/crontab`, run the command: $ sudo chgrp root /etc/crontab
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.

Verify Owner on cron.d

Rule ID	file_owner_cron_d
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.7, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the owner of `/etc/cron.d`, run the command: $ sudo chown root /etc/cron.d
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct user to prevent unauthorized changes.

Verify Owner on cron.daily

Rule ID	file_owner_cron_daily
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.4, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the owner of `/etc/cron.daily`, run the command: $ sudo chown root /etc/cron.daily
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct user to prevent unauthorized changes.

Verify Owner on cron.hourly

Rule ID	file_owner_cron_hourly
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.3, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the owner of `/etc/cron.hourly`, run the command: $ sudo chown root /etc/cron.hourly
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct user to prevent unauthorized changes.

Verify Owner on cron.monthly

Rule ID	file_owner_cron_monthly
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.6, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the owner of `/etc/cron.monthly`, run the command: $ sudo chown root /etc/cron.monthly
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct user to prevent unauthorized changes.

Verify Owner on cron.weekly

Rule ID	file_owner_cron_weekly
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.5, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the owner of `/etc/cron.weekly`, run the command: $ sudo chown root /etc/cron.weekly
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct user to prevent unauthorized changes.

Verify Owner on crontab

Rule ID	file_owner_crontab
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.1.2, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the owner of `/etc/crontab`, run the command: $ sudo chown root /etc/crontab
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct user to prevent unauthorized changes.

Verify Permissions on cron.d

Rule ID file_permissions_cron_d

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

To properly set the permissions of /etc/cron.d, run the command:

$ sudo chmod 0700 /etc/cron.d

Rationale

Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the correct access rights to prevent unauthorized changes.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

chmod 0700 /etc/cron.d/

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/cron.d/
  stat:
    path: /etc/cron.d/
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_cron_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0700 on /etc/cron.d/
  file:
    path: /etc/cron.d/
    mode: '0700'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_cron_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

Verify Permissions on cron.daily

Rule ID file_permissions_cron_daily

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

To properly set the permissions of /etc/cron.daily, run the command:

$ sudo chmod 0700 /etc/cron.daily

Rationale

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

chmod 0700 /etc/cron.daily/

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/cron.daily/
  stat:
    path: /etc/cron.daily/
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_cron_daily
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0700 on /etc/cron.daily/
  file:
    path: /etc/cron.daily/
    mode: '0700'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_cron_daily
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

Verify Permissions on cron.hourly

Rule ID file_permissions_cron_hourly

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

To properly set the permissions of /etc/cron.hourly, run the command:

$ sudo chmod 0700 /etc/cron.hourly

Rationale

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

chmod 0700 /etc/cron.hourly/

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/cron.hourly/
  stat:
    path: /etc/cron.hourly/
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_cron_hourly
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0700 on /etc/cron.hourly/
  file:
    path: /etc/cron.hourly/
    mode: '0700'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_cron_hourly
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

Verify Permissions on cron.monthly

Rule ID file_permissions_cron_monthly

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

To properly set the permissions of /etc/cron.monthly, run the command:

$ sudo chmod 0700 /etc/cron.monthly

Rationale

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

chmod 0700 /etc/cron.monthly/

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/cron.monthly/
  stat:
    path: /etc/cron.monthly/
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_cron_monthly
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0700 on /etc/cron.monthly/
  file:
    path: /etc/cron.monthly/
    mode: '0700'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_cron_monthly
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

Verify Permissions on cron.weekly

Rule ID file_permissions_cron_weekly

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

To properly set the permissions of /etc/cron.weekly, run the command:

$ sudo chmod 0700 /etc/cron.weekly

Rationale

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

chmod 0700 /etc/cron.weekly/

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/cron.weekly/
  stat:
    path: /etc/cron.weekly/
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_cron_weekly
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0700 on /etc/cron.weekly/
  file:
    path: /etc/cron.weekly/
    mode: '0700'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_cron_weekly
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

Verify Permissions on crontab

Rule ID file_permissions_crontab

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

To properly set the permissions of /etc/crontab, run the command:

$ sudo chmod 0600 /etc/crontab

Rationale

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

chmod 0600 /etc/crontab

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/crontab
  stat:
    path: /etc/crontab
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_crontab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0600 on /etc/crontab
  file:
    path: /etc/crontab
    mode: '0600'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_crontab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

Uninstall the nis package

Rule ID	package_nis_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	low
Identifiers and References	References: CIS§2.2.17
Description	The support for Yellowpages should not be installed unless it is required.
Rationale	NIS is the historical SUN service for central account management, more and more replaced by LDAP. NIS does not support efficiently security constraints, ACL, etc. and should not be used.

Uninstall DHCP Server Package

Rule ID	package_dhcp_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R1), CIS§2.2.5, CIS-CSC§11, CIS-CSC§14, CIS-CSC§3, CIS-CSC§9, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS06.06, DISA§CCI-000366, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3
Description	If the system does not need to act as a DHCP server, the dhcp package can be uninstalled. The `isc-dhcp-server` package can be removed with the following command: $ apt-get remove isc-dhcp-server
Rationale	Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.

Uninstall bind Package

Rule ID	package_bind_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	low
Identifiers and References	References: CIS§2.2.8, CIS-CSC§11, CIS-CSC§14, CIS-CSC§3, CIS-CSC§9, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS06.06, DISA§CCI-000366, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3
Description	The `named` service is provided by the `bind` package. The `bind` package can be removed with the following command: $ apt-get remove bind
Rationale	If there is no need to make DNS server software available, removing it provides a safeguard against its activation.

Uninstall vsftpd Package

Rule ID	package_vsftpd_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	high
Identifiers and References	References: CIS§2.2.9, CIS-CSC§11, CIS-CSC§14, CIS-CSC§3, CIS-CSC§9, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS06.06, DISA§CCI-000197, DISA§CCI-000366, DISA§CCI-000381, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST§IA-5(1)(c), NIST§IA-5(1).1(v), NIST§CM-7, NIST§CM-7.1(ii), NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, SRG§SRG-OS-000074-GPOS-00042, SRG§SRG-OS-000095-GPOS-00049, SRG§SRG-OS-000480-GPOS-00227
Description	The `vsftpd` package can be removed with the following command: $ apt-get remove vsftpd
Rationale	Removing the `vsftpd` package decreases the risk of its accidental activation.

Uninstall httpd Package

Rule ID	package_httpd_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	unknown
Identifiers and References	References: CIS§2.2.10, CIS-CSC§11, CIS-CSC§14, CIS-CSC§3, CIS-CSC§9, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS06.06, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3
Description	The `apache2` package can be removed with the following command: $ apt-get remove apache2
Rationale	If there is no need to make the web server software available, removing it provides a safeguard against its activation.

Uninstall dovecot Package

Rule ID	package_dovecot_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	unknown
Identifiers and References	References: CIS§2.2.11
Description	The `dovecot-core` package can be removed with the following command: $ apt-get remove dovecot-core
Rationale	If there is no need to make the Dovecot software available, removing it provides a safeguard against its activation.

Ensure LDAP client is not installed

Rule ID	package_openldap-clients_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	low
Identifiers and References	References: CIS§2.3.5
Description	The Lightweight Directory Access Protocol (LDAP) is a service that provides a method for looking up information from a central database. The `openldap-clients` package can be removed with the following command: $ apt-get remove openldap-clients
Rationale	If the system does not need to act as an LDAP client, it is recommended that the software is removed to reduce the potential attack surface.

Uninstall openldap-servers Package

Rule ID	package_openldap-servers_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	low
Identifiers and References	References: CIS§2.2.6, CIS-CSC§11, CIS-CSC§14, CIS-CSC§3, CIS-CSC§9, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS06.06, DISA§CCI-000366, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3
Description	The slapd package is not installed by default on a Ubuntu 20.04 system. It is needed only by the OpenLDAP server, not by the clients which use LDAP for authentication. If the system is not intended for use as an LDAP Server it should be removed.
Rationale	Unnecessary packages should not be installed to decrease the attack surface of the system. While this software is clearly essential on an LDAP server, it is not necessary on typical desktop or workstation systems.

Disable Postfix Network Listening

Rule ID	postfix_network_listening_disabled
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R48), CIS§2.2.15, CIS-CSC§11, CIS-CSC§14, CIS-CSC§3, CIS-CSC§9, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS06.06, DISA§CCI-000382, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3
Description	Edit the file `/etc/postfix/main.cf` to ensure that only the following `inet_interfaces` line appears: inet_interfaces = loopback-only
Rationale	This ensures `postfix` accepts mail messages (such as cron job reports) from the local system only, and not from the network, which protects it from network attack.

Ensure mail transfer agent is configured for local-only mode

Rule ID	has_nonlocal_mta
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§2.2.15
Description	Mail Transfer Agents (MTA), such as sendmail and Postfix, are used to listen for incoming mail and transfer the messages to the appropriate user or mail server. If the system is not intended to be a mail server, it is recommended that the MTA be configured to only process local mail.
Rationale	The software for all Mail Transfer Agents is complex and most have a long history of security issues. While it is important to ensure that the system can process local mail messages, it is not necessary to have the MTA's daemon listening on a port unless the server is intended to be a mail server that receives and processes mail from other systems.

Uninstall nfs-kernel-server Package

Rule ID	package_nfs-kernel-server_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	low
Identifiers and References	References: CIS§2.2.7
Description	The `nfs-kernel-server` package can be removed with the following command: $ apt-get remove nfs-kernel-server
Rationale	If the system does not export NFS shares or act as an NFS client, it is recommended that these services be removed to reduce the remote attack surface.

Uninstall rpcbind Package

Rule ID	package_rpcbind_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	low
Identifiers and References	References: CIS§2.3.6
Description	The `rpcbind` package can be removed with the following command: $ apt-get remove rpcbind
Rationale	If RPC is not required, it is recommended that this services be removed to reduce the remote attack surface.

The Chrony package is installed

Rule ID	package_chrony_installed
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R43), CIS§2.2.1.1, ISM§0988, ISM§1405, OSPP§FMT_SMF_EXT.1, SRG§SRG-OS-000355-GPOS-00143, STIGID§UBTU-20-010435
Description	System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all systems synchronize their clocks to them. The `chrony` package can be installed with the following command: $ apt-get install chrony
Rationale	Time synchronization is important to support time sensitive security mechanisms like Kerberos and also ensures log files have consistent time records across the enterprise, which aids in forensic investigations.

Install the ntp service

Rule ID	package_ntp_installed
Result	pass
Time	2023-09-07T09:13:40
Severity	high
Identifiers and References	References: ANSSI§NT012(R03), CIS§2.2.1.4, CIS-CSC§1, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, COBIT5§APO11.04, COBIT5§BAI03.05, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§MEA02.01, DISA§CCI-000160, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, NIST§CM-6(a), NIST-CSF§PR.PT-1, PCIDSS§Req-10.4
Description	The ntpd service should be installed.
Rationale	Time synchronization (using NTP) is required by almost all network and administrative tasks (syslog, cryptographic based services (authentication, etc.), etc.). Ntpd is regulary maintained and updated, supporting security features such as RFC 5906.

The Chrony package is removed

Rule ID	package_chrony_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R43), CIS§2.2.1.4, ISM§0988, ISM§1405, OSPP§FMT_SMF_EXT.1, SRG§SRG-OS-000355-GPOS-00143
Description	System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all systems synchronize their clocks to them. The `chrony` package can be removed with the following command: $ apt-get remove chrony
Rationale	Time synchronization is important to support time sensitive security mechanisms like Kerberos and also ensures log files have consistent time records across the enterprise, which aids in forensic investigations.

Remove the ntp package

Rule ID	package_ntp_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	high
Identifiers and References	References: ANSSI§NT012(R03), CIS§2.2.1.1, CIS-CSC§1, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, COBIT5§APO11.04, COBIT5§BAI03.05, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§MEA02.01, DISA§CCI-000160, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, NIST§CM-6(a), NIST-CSF§PR.PT-1, PCIDSS§Req-10.4
Description	The ntpd service should be removed.
Rationale	Time synchronization (using NTP) is required by almost all network and administrative tasks (syslog, cryptographic based services (authentication, etc.), etc.). Ntpd is regulary maintained and updated, supporting security features such as RFC 5906.

Enable the Chrony Daemon

Rule ID	service_chrony_enabled
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§2.1.1.1, ISM§0988, ISM§1405
Description	chrony is a daemon which implements the Network Time Protocol (NTP) is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on chrony can be found at http://chrony.tuxfamily.org/. Chrony can be configured to be a client and/or a server. To enable Chronyd service, you can run: `# systemctl enable chronyd.service` This recommendation only applies if chrony is in use on the system.
Rationale	If chrony is in use on the system proper configuration is vital to ensuring time synchronization is working properly.

Enable the NTP Daemon

Rule ID	service_ntp_enabled
Result	pass
Time	2023-09-07T09:13:40
Severity	high
Identifiers and References	References: ANSSI§NT012(R03), CIS§2.2.1.4, CIS-CSC§1, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§3, CIS-CSC§5, CIS-CSC§6, COBIT5§APO11.04, COBIT5§BAI03.05, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§MEA02.01, DISA§CCI-000160, ISA-62443-2009§4.3.3.3.9, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.4.4.7, ISA-62443-2009§4.4.2.1, ISA-62443-2009§4.4.2.2, ISA-62443-2009§4.4.2.4, ISA-62443-2013§SR 2.10, ISA-62443-2013§SR 2.11, ISA-62443-2013§SR 2.12, ISA-62443-2013§SR 2.8, ISA-62443-2013§SR 2.9, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.2, ISO27001-2013§A.12.4.3, ISO27001-2013§A.12.4.4, ISO27001-2013§A.12.7.1, NIST§CM-6(a), NIST§AU-8(1)(a), NIST-CSF§PR.PT-1, PCIDSS§Req-10.4
Description	The `ntp` service can be enabled with the following command: $ sudo systemctl enable ntp.service
Rationale	Enabling the `ntp` service ensures that the `ntp` service will be running and that the system will synchronize its time to any servers specified. This is important whether the system is configured to be a client (and synchronize only its own clock) or it is also acting as an NTP server to other systems. Synchronizing time is essential for authentication services such as Kerberos, but it is also important for maintaining accurate logs and auditing possible security breaches. The NTP daemon offers all of the functionality of `ntpdate`, which is now deprecated.

Ensure that chronyd is running under chrony user account

Rule ID	chronyd_run_as_chrony_user
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§2.2.1.3
Description	chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on chrony can be found at http://chrony.tuxfamily.org/. Chrony can be configured to be a client and/or a server. To ensure that chronyd is running under chrony user account, Add or edit the `user` variable in `/etc/chrony/chrony.conf` is set to `_chrony` or is absent: user _chrony This recommendation only applies if chrony is in use on the system.
Rationale	If chrony is in use on the system proper configuration is vital to ensuring time synchronization is working properly.

A remote time server for Chrony is configured

Rule ID	chronyd_specify_remote_server
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R43), CIS§2.2.1.3, ISM§0988, ISM§1405
Description	`Chrony` is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on `chrony` can be found at http://chrony.tuxfamily.org/. `Chrony` can be configured to be a client and/or a server. Add or edit server or pool lines to `/etc/chrony/chrony.conf` as appropriate: server <remote-server> Multiple servers may be configured.
Rationale	If `chrony` is in use on the system proper configuration is vital to ensuring time synchronization is working properly.

Uninstall openbsd-inetd Package

Rule ID	package_openbsd-inetd_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	low
Identifiers and References	References: CIS§2.1.2
Description	The `openbsd-inetd` package can be removed with the following command: $ apt-get remove openbsd-inetd
Rationale	If there are no inetd services required, it is recommended that the daemon be removed.

Uninstall xinetd Package

Rule ID	package_xinetd_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	low
Identifiers and References	References: ANSSI§BP28(R1), CIS§2.1.1, CIS-CSC§11, CIS-CSC§12, CIS-CSC§14, CIS-CSC§15, CIS-CSC§3, CIS-CSC§8, CIS-CSC§9, COBIT5§APO13.01, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.04, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.05, COBIT5§DSS06.06, DISA§CCI-000305, HIPAA§164.308(a)(4)(i), HIPAA§164.308(b)(1), HIPAA§164.308(b)(3), HIPAA§164.310(b), HIPAA§164.312(e)(1), HIPAA§164.312(e)(2)(ii), ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST-CSF§PR.AC-3, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, NIST-CSF§PR.PT-4
Description	The `xinetd` package can be removed with the following command: $ apt-get remove xinetd
Rationale	Removing the `xinetd` package decreases the risk of the xinetd service's accidental (or intentional) activation.

Uninstall rsh Package

Rule ID	package_rsh_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	unknown
Identifiers and References	References: ANSSI§BP28(R1), CIS§2.3.2, CUI§3.1.13, HIPAA§164.308(a)(4)(i), HIPAA§164.308(b)(1), HIPAA§164.308(b)(3), HIPAA§164.310(b), HIPAA§164.312(e)(1), HIPAA§164.312(e)(2)(ii), ISO27001-2013§A.8.2.3, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3
Description	The `rsh-client` package contains the client commands for the rsh services
Rationale	These legacy clients contain numerous security exposures and have been replaced with the more secure SSH package. Even if the server is removed, it is best to ensure the clients are also removed to prevent users from inadvertently attempting to use these commands and therefore exposing their credentials. Note that removing the `rsh-client` package removes the clients for `rsh`,`rcp`, and `rlogin`.

Remove Rsh Trust Files

Rule ID	no_rsh_trust_files
Result	pass
Time	2023-09-07T09:13:40
Severity	high
Identifiers and References	References: CIS§6.2.11, CIS-CSC§11, CIS-CSC§12, CIS-CSC§14, CIS-CSC§15, CIS-CSC§3, CIS-CSC§8, CIS-CSC§9, COBIT5§APO13.01, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS01.04, COBIT5§DSS05.02, COBIT5§DSS05.03, COBIT5§DSS05.05, COBIT5§DSS06.06, DISA§CCI-001436, HIPAA§164.308(a)(4)(i), HIPAA§164.308(b)(1), HIPAA§164.308(b)(3), HIPAA§164.310(b), HIPAA§164.312(e)(1), HIPAA§164.312(e)(2)(ii), ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 3.1, ISA-62443-2013§SR 3.5, ISA-62443-2013§SR 3.8, ISA-62443-2013§SR 4.1, ISA-62443-2013§SR 4.3, ISA-62443-2013§SR 5.1, ISA-62443-2013§SR 5.2, ISA-62443-2013§SR 5.3, ISA-62443-2013§SR 7.1, ISA-62443-2013§SR 7.6, ISO27001-2013§A.11.2.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.14.1.3, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.6.2.1, ISO27001-2013§A.6.2.2, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST-CSF§PR.AC-3, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, NIST-CSF§PR.PT-4
Description	The files `/etc/hosts.equiv` and `~/.rhosts` (in each user's home directory) list remote hosts and users that are trusted by the local system when using the rshd daemon. To remove these files, run the following command to delete them from any location: $ sudo rm /etc/hosts.equiv $ rm ~/.rhosts
Rationale	This action is only meaningful if `.rhosts` support is permitted through PAM. Trust files are convenient, but when used in conjunction with the R-services, they can allow unauthenticated access to a system.

Uninstall talk Package

Rule ID	package_talk_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R1), CIS§2.3.3, HIPAA§164.308(a)(4)(i), HIPAA§164.308(b)(1), HIPAA§164.308(b)(3), HIPAA§164.310(b), HIPAA§164.312(e)(1), HIPAA§164.312(e)(2)(ii)
Description	The `talk` package contains the client program for the Internet talk protocol, which allows the user to chat with other users on different systems. Talk is a communication program which copies lines from one terminal to the terminal of another user. The `talk` package can be removed with the following command: $ apt-get remove talk
Rationale	The talk software presents a security risk as it uses unencrypted protocols for communications. Removing the `talk` package decreases the risk of the accidental (or intentional) activation of talk client program.

Remove telnet Clients

Rule ID package_telnet_removed

Result

fail

Time 2023-09-07T09:13:40

Severity low

Identifiers and References

References: ANSSI§BP28(R1), CIS§2.3.4, CUI§3.1.13, HIPAA§164.308(a)(4)(i), HIPAA§164.308(b)(1), HIPAA§164.308(b)(3), HIPAA§164.310(b), HIPAA§164.312(e)(1), HIPAA§164.312(e)(2)(ii), ISO27001-2013§A.8.2.3, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3

Description

The telnet client allows users to start connections to other systems via the telnet protocol.

Rationale

The telnet protocol is insecure and unencrypted. The use of an unencrypted transmission medium could allow an unauthorized user to steal credentials. The ssh package provides an encrypted session and stronger security and is included in Ubuntu 20.04.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	disable


# CAUTION: This remediation script will remove telnet
#	   from the system, and may remove any packages
#	   that depend on telnet. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

DEBIAN_FRONTEND=noninteractive apt-get remove -y "telnet"

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	disable

- name: Ensure telnet is removed
  package:
    name: telnet
    state: absent
  tags:
    - NIST-800-171-3.1.13
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_telnet_removed

Remediation Puppet snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	disable

include remove_telnet

class remove_telnet {
  package { 'telnet':
    ensure => 'purged',
  }
}

Uninstall rsync Package

Rule ID package_rsync_removed

Result

fail

Time 2023-09-07T09:13:40

Severity low

Identifiers and References

References: CIS§2.2.16

Description

The rsync package can be removed with the following command:

$ apt-get remove rsync

Rationale

The rsync service presents a security risk as it uses unencrypted protocols for communication. The rsync package should be removed to reduce the attack area of the system.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	disable


# CAUTION: This remediation script will remove rsync
#	   from the system, and may remove any packages
#	   that depend on rsync. Execute this
#	   remediation AFTER testing on a non-production
#	   system!

DEBIAN_FRONTEND=noninteractive apt-get remove -y "rsync"

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	disable

- name: Ensure rsync is removed
  package:
    name: rsync
    state: absent
  tags:
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_rsync_removed

Remediation Puppet snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	disable

include remove_rsync

class remove_rsync {
  package { 'rsync':
    ensure => 'purged',
  }
}

Uninstall cups Package

Rule ID	package_cups_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	low
Identifiers and References	References: CIS§2.2.4
Description	The `cups` package can be removed with the following command: $ apt-get remove cups
Rationale	If the system does not need to print jobs or accept print jobs from other systems, it is recommended that CUPS be removed to reduce the potential attack surface.

Disable the CUPS Service

Rule ID	service_cups_disabled
Result	pass
Time	2023-09-07T09:13:40
Severity	unknown
Identifiers and References	References: CIS§2.2.4, CIS-CSC§11, CIS-CSC§14, CIS-CSC§3, CIS-CSC§9, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.05, COBIT5§DSS06.06, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.9.1.2, NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3
Description	The `cups` service can be disabled with the following command: $ sudo systemctl mask --now cups.service
Rationale	Turn off unneeded services to reduce attack surface.

Uninstall squid Package

Rule ID	package_squid_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	unknown
Identifiers and References	References: CIS§2.2.13
Description	The `squid` package can be removed with the following command: $ apt-get remove squid
Rationale	If there is no need to make the proxy server software available, removing it provides a safeguard against its activation.

Uninstall Samba Package

Rule ID	package_samba_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	unknown
Identifiers and References	References: CIS§2.2.12
Description	The `samba` package can be removed with the following command: $ apt-get remove samba
Rationale	If there is no need to make the Samba software available, removing it provides a safeguard against its activation.

Uninstall net-snmp Package

Rule ID	package_net-snmp_removed
Result	pass
Time	2023-09-07T09:13:40
Severity	unknown
Identifiers and References	References: CIS§2.2.14
Description	The `snmp` package provides the snmpd service. The `snmp` package can be removed with the following command: $ apt-get remove snmp
Rationale	If there is no need to run SNMP server software, removing the package provides a safeguard against its activation.

Restrict sshd user access via AllowGroups

Rule ID	sshd_configure_allow_groups
Result	fail
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.2.17
Description	AllowGroups gives the system administrator the option of allowing specific groups to ssh into the system. - The list consists of space separated group names - Numeric group IDs are not recognized with this variable
Rationale	Restricting which users can remotely access the system via SSH will help ensure that only authorized users access the system.
Remediation Shell script: (show) # Remediation is applicable only in certain platforms if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then var_sshd_allow_groups_valid='e39d05b72f25767869d44391919434896bb055772d7969f74472032b03bc18418911f3b0e6dd47ff8f3b2323728225286c3cb36914d28dc7db40bdd786159c0a' # We don't add the default magic value to the sshd config file, since it's a security risk. default_value="e39d05b72f25767869d44391919434896bb055772d7969f74472032b03bc18418911f3b0e6dd47ff8f3b2323728225286c3cb36914d28dc7db40bdd786159c0a" if [ "${var_sshd_allow_groups_valid}" != ${default_value} ]; then if [ -e "/etc/ssh/sshd_config" ] ; then LC_ALL=C sed -i "/^\sAllowGroups\s\+/Id" "/etc/ssh/sshd_config" else touch "/etc/ssh/sshd_config" fi cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak" # Insert before the line matching the regex '^Match'. line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" \| LC_ALL=C sed 's/:.//g')" if [ -z "$line_number" ]; then # There was no match of '^Match', insert at # the end of the file. printf '%s\n' "AllowGroups $var_sshd_allow_groups_valid" >> "/etc/ssh/sshd_config" else head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config" printf '%s\n' "AllowGroups $var_sshd_allow_groups_valid" >> "/etc/ssh/sshd_config" tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config" fi # Clean up after ourselves. rm "/etc/ssh/sshd_config.bak" fi else >&2 echo 'Remediation is not applicable, nothing was done' fi

Restrict sshd user access via AllowUsers

Rule ID	sshd_configure_allow_users
Result	fail
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.2.17
Description	AllowUsers gives the system administrator the option of allowing specific users to ssh into the system. - The list consists of space separated user names - Numeric user IDs are not recognized with this variable - A system administrator may restrict user access further by only allowing the allowed users to log in from a particular host by specifying the entry as user@host.
Rationale	Restricting which users can remotely access the system via SSH will help ensure that only authorized users access the system.
Remediation Shell script: (show) # Remediation is applicable only in certain platforms if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then var_sshd_allow_users_valid='e39d05b72f25767869d44391919434896bb055772d7969f74472032b03bc18418911f3b0e6dd47ff8f3b2323728225286c3cb36914d28dc7db40bdd786159c0a' # We don't add the default magic value to the sshd config file, since it's a security risk. default_value="e39d05b72f25767869d44391919434896bb055772d7969f74472032b03bc18418911f3b0e6dd47ff8f3b2323728225286c3cb36914d28dc7db40bdd786159c0a" if [ "${var_sshd_allow_users_valid}" != ${default_value} ]; then if [ -e "/etc/ssh/sshd_config" ] ; then LC_ALL=C sed -i "/^\sAllowUsers\s\+/Id" "/etc/ssh/sshd_config" else touch "/etc/ssh/sshd_config" fi cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak" # Insert before the line matching the regex '^Match'. line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" \| LC_ALL=C sed 's/:.//g')" if [ -z "$line_number" ]; then # There was no match of '^Match', insert at # the end of the file. printf '%s\n' "AllowUsers $var_sshd_allow_users_valid" >> "/etc/ssh/sshd_config" else head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config" printf '%s\n' "AllowUsers $var_sshd_allow_users_valid" >> "/etc/ssh/sshd_config" tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config" fi # Clean up after ourselves. rm "/etc/ssh/sshd_config.bak" fi else >&2 echo 'Remediation is not applicable, nothing was done' fi

Restrict sshd user access via DenyGroups

Rule ID	sshd_configure_deny_groups
Result	fail
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.2.17
Description	DenyGroups gives the system administrator the option of denying specific groups to ssh into the system. - The list consists of space separated group names. - Numeric group IDs are not recognized with this variable.
Rationale	Restricting which users can remotely access the system via SSH will help ensure that only authorized users access the system.
Remediation Shell script: (show) # Remediation is applicable only in certain platforms if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then var_sshd_deny_groups_valid='e39d05b72f25767869d44391919434896bb055772d7969f74472032b03bc18418911f3b0e6dd47ff8f3b2323728225286c3cb36914d28dc7db40bdd786159c0a' # We don't add the default magic value to the sshd config file, since it's a security risk. default_value="e39d05b72f25767869d44391919434896bb055772d7969f74472032b03bc18418911f3b0e6dd47ff8f3b2323728225286c3cb36914d28dc7db40bdd786159c0a" if [ "${var_sshd_deny_groups_valid}" != ${default_value} ]; then if [ -e "/etc/ssh/sshd_config" ] ; then LC_ALL=C sed -i "/^\sDenyGroups\s\+/Id" "/etc/ssh/sshd_config" else touch "/etc/ssh/sshd_config" fi cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak" # Insert before the line matching the regex '^Match'. line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" \| LC_ALL=C sed 's/:.//g')" if [ -z "$line_number" ]; then # There was no match of '^Match', insert at # the end of the file. printf '%s\n' "DenyGroups $var_sshd_deny_groups_valid" >> "/etc/ssh/sshd_config" else head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config" printf '%s\n' "DenyGroups $var_sshd_deny_groups_valid" >> "/etc/ssh/sshd_config" tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config" fi # Clean up after ourselves. rm "/etc/ssh/sshd_config.bak" fi else >&2 echo 'Remediation is not applicable, nothing was done' fi

Restrict sshd user access via DenyUsers

Rule ID	sshd_configure_deny_users
Result	fail
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.2.17
Description	DenyUsers gives the system administrator the option of denying specific users to ssh into the system. - The list consists of space separated user names - Numeric user IDs are not recognized with this variable - A system administrator may restrict user access further by only allowing the allowed users to log in from a particular host by specifying the entry as user@host.
Rationale	Restricting which users can remotely access the system via SSH will help ensure that only authorized users access the system.
Remediation Shell script: (show) # Remediation is applicable only in certain platforms if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then var_sshd_deny_users_valid='e39d05b72f25767869d44391919434896bb055772d7969f74472032b03bc18418911f3b0e6dd47ff8f3b2323728225286c3cb36914d28dc7db40bdd786159c0a' # We don't add the default magic value to the sshd config file, since it's a security risk. default_value="e39d05b72f25767869d44391919434896bb055772d7969f74472032b03bc18418911f3b0e6dd47ff8f3b2323728225286c3cb36914d28dc7db40bdd786159c0a" if [ "${var_sshd_deny_users_valid}" != ${default_value} ]; then if [ -e "/etc/ssh/sshd_config" ] ; then LC_ALL=C sed -i "/^\sDenyUsers\s\+/Id" "/etc/ssh/sshd_config" else touch "/etc/ssh/sshd_config" fi cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak" # Insert before the line matching the regex '^Match'. line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" \| LC_ALL=C sed 's/:.//g')" if [ -z "$line_number" ]; then # There was no match of '^Match', insert at # the end of the file. printf '%s\n' "DenyUsers $var_sshd_deny_users_valid" >> "/etc/ssh/sshd_config" else head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config" printf '%s\n' "DenyUsers $var_sshd_deny_users_valid" >> "/etc/ssh/sshd_config" tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config" fi # Clean up after ourselves. rm "/etc/ssh/sshd_config.bak" fi else >&2 echo 'Remediation is not applicable, nothing was done' fi

Disable Host-Based Authentication

Rule ID	disable_host_auth
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.2.8, CIS-CSC§11, CIS-CSC§12, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CIS-CSC§9, CJIS§5.5.6, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, COBIT5§DSS05.02, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS06.03, COBIT5§DSS06.06, CUI§3.1.12, DISA§CCI-000366, HIPAA§164.308(a)(4)(i), HIPAA§164.308(b)(1), HIPAA§164.308(b)(3), HIPAA§164.310(b), HIPAA§164.312(e)(1), HIPAA§164.312(e)(2)(ii), ISA-62443-2009§4.3.3.2.2, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.5.3, ISA-62443-2009§4.3.3.5.4, ISA-62443-2009§4.3.3.5.5, ISA-62443-2009§4.3.3.5.6, ISA-62443-2009§4.3.3.5.7, ISA-62443-2009§4.3.3.5.8, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.1, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.11, ISA-62443-2013§SR 1.12, ISA-62443-2013§SR 1.13, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.6, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 2.2, ISA-62443-2013§SR 2.3, ISA-62443-2013§SR 2.4, ISA-62443-2013§SR 2.5, ISA-62443-2013§SR 2.6, ISA-62443-2013§SR 2.7, ISA-62443-2013§SR 7.6, ISM§0421, ISM§0422, ISM§0431, ISM§0974, ISM§1173, ISM§1401, ISM§1504, ISM§1505, ISM§1546, ISM§1557, ISM§1558, ISM§1559, ISM§1560, ISM§1561, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.1, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.2.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.2, NERC-CIP§CIP-007-3 R5.2, NERC-CIP§CIP-007-3 R5.3.1, NERC-CIP§CIP-007-3 R5.3.2, NERC-CIP§CIP-007-3 R5.3.3, NIST§AC-3, NIST§AC-17(a), NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST-CSF§PR.AC-4, NIST-CSF§PR.AC-6, NIST-CSF§PR.IP-1, NIST-CSF§PR.PT-3, OSPP§FIA_UAU.1, SRG§SRG-OS-000480-GPOS-00229, VMMSRG§SRG-OS-000480-VMM-002000
Description	SSH's cryptographic host-based authentication is more secure than `.rhosts` authentication. However, it is not recommended that hosts unilaterally trust one another, even within an organization. To disable host-based authentication, add or correct the following line in `/etc/ssh/sshd_config`: HostbasedAuthentication no
Rationale	SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.

Disable SSH Access via Empty Passwords

Rule ID sshd_disable_empty_passwords

Result

fail

Time 2023-09-07T09:13:40

Severity high

Identifiers and References

Description

To explicitly disallow SSH login from accounts with empty passwords, add or correct the following line in /etc/ssh/sshd_config:

PermitEmptyPasswords no

Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.

Rationale

Configuring this setting for the SSH daemon provides additional assurance that remote login via SSH will require a password, even in the event of misconfiguration elsewhere.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitEmptyPasswords\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PermitEmptyPasswords no" >> "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config"
    printf '%s\n' "PermitEmptyPasswords no" >> "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Disable SSH Access via Empty Passwords
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitEmptyPasswords\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitEmptyPasswords\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*PermitEmptyPasswords\s+
        line: PermitEmptyPasswords no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - DISA-STIG-UBTU-20-010047
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_empty_passwords

Disable SSH Support for .rhosts Files

Rule ID sshd_disable_rhosts

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

SSH can emulate the behavior of the obsolete rsh command in allowing users to enable insecure access to their accounts via .rhosts files.

To ensure this behavior is disabled, add or correct the following line in /etc/ssh/sshd_config:

IgnoreRhosts yes

Rationale

SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*IgnoreRhosts\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "IgnoreRhosts yes" >> "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config"
    printf '%s\n' "IgnoreRhosts yes" >> "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Disable SSH Support for .rhosts Files
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*IgnoreRhosts\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*IgnoreRhosts\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*IgnoreRhosts\s+
        line: IgnoreRhosts yes
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_rhosts

Disable SSH Root Login

Rule ID sshd_disable_root_login

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line in /etc/ssh/sshd_config:

PermitRootLogin no

Rationale

Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account provides individual accountability of actions performed on the system and also helps to minimize direct attack attempts on root's password.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PermitRootLogin no" >> "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config"
    printf '%s\n' "PermitRootLogin no" >> "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Disable SSH Root Login
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitRootLogin\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitRootLogin\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*PermitRootLogin\s+
        line: PermitRootLogin no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(2)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-IA-2
    - NIST-800-53-IA-2(5)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_root_login

Disable SSH TCP Forwarding

Rule ID sshd_disable_tcp_forwarding

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

References: CIS§5.2.20

Description

The AllowTcpForwarding parameter specifies whether TCP forwarding is permitted. To disable TCP forwarding, add or correct the following line in /etc/ssh/sshd_config:

AllowTcpForwarding no

Rationale

Leaving port forwarding enabled can expose the organization to security risks and back-doors.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*AllowTcpForwarding\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "AllowTcpForwarding no" >> "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config"
    printf '%s\n' "AllowTcpForwarding no" >> "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Disable SSH TCP Forwarding
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*AllowTcpForwarding\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*AllowTcpForwarding\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*AllowTcpForwarding\s+
        line: AllowTcpForwarding no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_tcp_forwarding

Disable X11 Forwarding

Rule ID sshd_disable_x11_forwarding

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

References: CIS§5.2.5, DISA§CCI-000366, NIST§CM-6(b), SRG§SRG-OS-000480-GPOS-00227, STIGID§UBTU-20-010048

Description

The X11Forwarding parameter provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections. SSH has the capability to encrypt remote X11 connections when SSH's X11Forwarding option is enabled.

To disable X11 Forwarding, add or correct the following line in /etc/ssh/sshd_config:

X11Forwarding no

Rationale

Disable X11 forwarding unless there is an operational requirement to use X11 applications directly. There is a small risk that the remote X11 servers of users who are logged in via SSH with X11 forwarding could be compromised by other users on the X11 server. Note that even if X11 forwarding is disabled, users can always install their own forwarders.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "X11Forwarding no" >> "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config"
    printf '%s\n' "X11Forwarding no" >> "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Disable X11 Forwarding
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*X11Forwarding\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*X11Forwarding\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*X11Forwarding\s+
        line: X11Forwarding no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - DISA-STIG-UBTU-20-010048
    - NIST-800-53-CM-6(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_x11_forwarding

Do Not Allow SSH Environment Options

Rule ID sshd_do_not_permit_user_env

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

References: CIS§5.2.11, CIS-CSC§11, CIS-CSC§3, CIS-CSC§9, CJIS§5.5.6, COBIT5§BAI10.01, COBIT5§BAI10.02, COBIT5§BAI10.03, COBIT5§BAI10.05, CUI§3.1.12, DISA§CCI-000366, HIPAA§164.308(a)(4)(i), HIPAA§164.308(b)(1), HIPAA§164.308(b)(3), HIPAA§164.310(b), HIPAA§164.312(e)(1), HIPAA§164.312(e)(2)(ii), ISA-62443-2009§4.3.4.3.2, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 7.6, ISO27001-2013§A.12.1.2, ISO27001-2013§A.12.5.1, ISO27001-2013§A.12.6.2, ISO27001-2013§A.14.2.2, ISO27001-2013§A.14.2.3, ISO27001-2013§A.14.2.4, NIST§AC-17(a), NIST§CM-7(a), NIST§CM-7(b), NIST§CM-6(a), NIST-CSF§PR.IP-1, SRG§SRG-OS-000480-GPOS-00229, STIGID§UBTU-20-010047, VMMSRG§SRG-OS-000480-VMM-002000

Description

To ensure users are not able to override environment variables of the SSH daemon, add or correct the following line in /etc/ssh/sshd_config:

PermitUserEnvironment no

Rationale

SSH environment options potentially allow users to bypass access restriction in some configurations.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitUserEnvironment\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "PermitUserEnvironment no" >> "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config"
    printf '%s\n' "PermitUserEnvironment no" >> "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Do Not Allow SSH Environment Options
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitUserEnvironment\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*PermitUserEnvironment\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*PermitUserEnvironment\s+
        line: PermitUserEnvironment no
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - DISA-STIG-UBTU-20-010047
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_do_not_permit_user_env

Enable PAM

Rule ID	sshd_enable_pam
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.2.19
Description	UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication in addition to PAM account and session module processing for all authentication types. To enable PAM authentication, add or correct the following line in the `/etc/ssh/sshd_config` file: UsePAM yes
Rationale	When UsePAM is set to yes, PAM runs through account and session types properly. This is important if you want to restrict access to services based off of IP, time or other factors of the account. Additionally, you can make sure users inherit certain environment variables on login or disallow access to the server.

Enable SSH Warning Banner

Rule ID sshd_enable_warning_banner_net

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

To enable the warning banner and ensure it is consistent across the system, add or correct the following line in /etc/ssh/sshd_config:

Banner /etc/issue.net

Another section contains information on how to create an appropriate system-wide warning banner.

Rationale

The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*Banner\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "Banner /etc/issue.net" >> "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config"
    printf '%s\n' "Banner /etc/issue.net" >> "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Enable SSH Warning Banner
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Banner\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Banner\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*Banner\s+
        line: Banner /etc/issue.net
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - DISA-STIG-UBTU-20-010038
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_warning_banner_net

Set SSH Idle Timeout Interval

Rule ID sshd_set_idle_timeout

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

References: ANSSI§BP28(R29), CIS§5.2.15, CIS-CSC§1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, CIS-CSC§7, CIS-CSC§8, CJIS§5.5.6, COBIT5§APO13.01, COBIT5§BAI03.01, COBIT5§BAI03.02, COBIT5§BAI03.03, COBIT5§DSS01.03, COBIT5§DSS03.05, COBIT5§DSS05.04, COBIT5§DSS05.05, COBIT5§DSS05.07, COBIT5§DSS05.10, COBIT5§DSS06.03, COBIT5§DSS06.10, CUI§3.1.11, DISA§CCI-000879, DISA§CCI-001133, DISA§CCI-002361, ISA-62443-2009§4.3.3.2.2, ISA-62443-2009§4.3.3.5.1, ISA-62443-2009§4.3.3.5.2, ISA-62443-2009§4.3.3.6.1, ISA-62443-2009§4.3.3.6.2, ISA-62443-2009§4.3.3.6.3, ISA-62443-2009§4.3.3.6.4, ISA-62443-2009§4.3.3.6.5, ISA-62443-2009§4.3.3.6.6, ISA-62443-2009§4.3.3.6.7, ISA-62443-2009§4.3.3.6.8, ISA-62443-2009§4.3.3.6.9, ISA-62443-2009§4.3.3.7.2, ISA-62443-2009§4.3.3.7.3, ISA-62443-2009§4.3.3.7.4, ISA-62443-2009§4.3.4.3.3, ISA-62443-2013§SR 1.1, ISA-62443-2013§SR 1.10, ISA-62443-2013§SR 1.2, ISA-62443-2013§SR 1.3, ISA-62443-2013§SR 1.4, ISA-62443-2013§SR 1.5, ISA-62443-2013§SR 1.7, ISA-62443-2013§SR 1.8, ISA-62443-2013§SR 1.9, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 6.2, ISO27001-2013§A.12.4.1, ISO27001-2013§A.12.4.3, ISO27001-2013§A.14.1.1, ISO27001-2013§A.14.2.1, ISO27001-2013§A.14.2.5, ISO27001-2013§A.18.1.4, ISO27001-2013§A.6.1.2, ISO27001-2013§A.6.1.5, ISO27001-2013§A.7.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.1, ISO27001-2013§A.9.2.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.2.4, ISO27001-2013§A.9.2.6, ISO27001-2013§A.9.3.1, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.2, ISO27001-2013§A.9.4.3, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-004-3 R2.2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.2, NERC-CIP§CIP-007-3 R5.3.1, NERC-CIP§CIP-007-3 R5.3.2, NERC-CIP§CIP-007-3 R5.3.3, NIST§CM-6(a), NIST§AC-17(a), NIST§AC-2(5), NIST§AC-12, NIST§AC-17(a), NIST§SC-10, NIST§CM-6(a), NIST-CSF§DE.CM-1, NIST-CSF§DE.CM-3, NIST-CSF§PR.AC-1, NIST-CSF§PR.AC-4, NIST-CSF§PR.AC-6, NIST-CSF§PR.AC-7, NIST-CSF§PR.IP-2, PCIDSS§Req-8.1.8, SRG§SRG-OS-000126-GPOS-00066, SRG§SRG-OS-000163-GPOS-00072, SRG§SRG-OS-000279-GPOS-00109, SRG§SRG-OS-000395-GPOS-00175, STIGID§UBTU-20-010037, VMMSRG§SRG-OS-000480-VMM-002000

Description

SSH allows administrators to set an idle timeout interval. After this interval has passed, the idle user will be automatically logged out.

To set an idle timeout interval, edit the following line in /etc/ssh/sshd_config as follows:

ClientAliveInterval 300

The timeout interval is given in seconds. For example, have a timeout of 10 minutes, set interval to 600.

If a shorter timeout has already been set for the login shell, that value will preempt any SSH setting made in /etc/ssh/sshd_config. Keep in mind that some processes may stop SSH from correctly detecting that the user is idle.

Rationale

Terminating an idle ssh session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been let unattended.

Warnings

warning SSH disconnecting idle clients will not have desired effect without also configuring ClientAliveCountMax in the SSH service configuration.

warning Following conditions may prevent the SSH session to time out:

Remote processes on the remote machine generates output. As the output has to be transferred over the network to the client, the timeout is reset every time such transfer happens.
Any scp or sftp activity by the same user to the host resets the timeout.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sshd_idle_timeout_value='300'



if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*ClientAliveInterval\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "ClientAliveInterval $sshd_idle_timeout_value" >> "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config"
    printf '%s\n' "ClientAliveInterval $sshd_idle_timeout_value" >> "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value sshd_idle_timeout_value # promote to variable
  set_fact:
    sshd_idle_timeout_value: !!str 300
  tags:
    - always

- name: Set SSH Idle Timeout Interval
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveInterval\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveInterval\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*ClientAliveInterval\s+
        line: ClientAliveInterval {{ sshd_idle_timeout_value }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - DISA-STIG-UBTU-20-010037
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_idle_timeout

Set SSH Client Alive Count Max

Rule ID sshd_set_keepalive

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

The SSH server sends at most ClientAliveCountMax messages during a SSH session and waits for a response from the SSH client. The option ClientAliveInterval configures timeout after each ClientAliveCountMax message. If the SSH server does not receive a response from the client, then the connection is considered idle and terminated. For SSH earlier than v8.2, a ClientAliveCountMax value of 0 causes an idle timeout precisely when the ClientAliveInterval is set. Starting with v8.2, a value of 0 disables the timeout functionality completely. If the option is set to a number greater than 0, then the idle session will be disconnected after ClientAliveInterval * ClientAliveCountMax seconds.

Rationale

This ensures a user login will be terminated as soon as the ClientAliveInterval is reached.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


var_sshd_set_keepalive='3'



if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*ClientAliveCountMax\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "ClientAliveCountMax $var_sshd_set_keepalive" >> "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config"
    printf '%s\n' "ClientAliveCountMax $var_sshd_set_keepalive" >> "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_sshd_set_keepalive # promote to variable
  set_fact:
    var_sshd_set_keepalive: !!str 3
  tags:
    - always

- name: Set SSH Client Alive Count Max
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveCountMax\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveCountMax\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*ClientAliveCountMax\s+
        line: ClientAliveCountMax {{ var_sshd_set_keepalive }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - DISA-STIG-UBTU-20-010036
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_keepalive

Set SSH LoginGraceTime limit

Rule ID sshd_set_login_grace_time

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

References: CIS§5.2.16

Description

The LoginGraceTime parameter specifies the time allowed for successful authentication to the SSH server. The longer the Grace period is the more open unauthenticated connections can exist. Like other session controls in this session the Grace Period should be limited to appropriate organizational limits to ensure the service is available for needed access. To set LoginGraceTime edit /etc/ssh/sshd_config as follows:

LoginGraceTime 60

Note: Local site policy may be more restrictive.

Rationale

Setting the LoginGraceTime parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. It will also limit the number of concurrent unauthenticated connections While the recommended setting is 60 seconds (1 Minute), set the number based on site policy.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


var_sshd_login_grace_time='60'



if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*LoginGraceTime\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "LoginGraceTime $var_sshd_login_grace_time" >> "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config"
    printf '%s\n' "LoginGraceTime $var_sshd_login_grace_time" >> "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: XCCDF Value var_sshd_login_grace_time # promote to variable
  set_fact:
    var_sshd_login_grace_time: !!str 60
  tags:
    - always

- name: Set SSH LoginGraceTime limit
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*LoginGraceTime\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*LoginGraceTime\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*LoginGraceTime\s+
        line: LoginGraceTime {{ var_sshd_login_grace_time }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sshd_set_login_grace_time

Set LogLevel to INFO or VERBOSE

Rule ID	sshd_set_loglevel_info_or_verbose
Result	fail
Time	2023-09-07T09:13:40
Severity	low
Identifiers and References	References: CIS§5.2.4
Description	The LogLevel parameter specifices that record login and logout activity will be logged. To specify the log level in SSH, add or correct the following line in the `/etc/ssh/sshd_config` file: LogLevel INFO or LogLevel INFO
Rationale	SSH provides several logging levels with varying amounts of verbosity. `DEBUG` is specifically not recommended other than strictly for debugging SSH communications since it provides so much data that it is difficult to identify important security information. `INFO` level is the basic level that only records login activity of SSH users. `VERBOSE` provides additional information on the top of what `INFO` provides. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.
Remediation Shell script: (show) # Remediation is applicable only in certain platforms if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then #!/bin/bash var_sshd_set_loglevel='INFO' if [ -e "/etc/ssh/sshd_config" ] ; then LC_ALL=C sed -i "/^\sLogLevel\s\+/Id" "/etc/ssh/sshd_config" else touch "/etc/ssh/sshd_config" fi cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak" # Insert before the line matching the regex '^Match'. line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" \| LC_ALL=C sed 's/:.//g')" if [ -z "$line_number" ]; then # There was no match of '^Match', insert at # the end of the file. printf '%s\n' "LogLevel $var_sshd_set_loglevel" >> "/etc/ssh/sshd_config" else head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config" printf '%s\n' "LogLevel $var_sshd_set_loglevel" >> "/etc/ssh/sshd_config" tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config" fi # Clean up after ourselves. rm "/etc/ssh/sshd_config.bak" else >&2 echo 'Remediation is not applicable, nothing was done' fi

Set SSH authentication attempt limit

Rule ID	sshd_set_max_auth_tries
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.2.6, ISM§0421, ISM§0422, ISM§0431, ISM§0974, ISM§1173, ISM§1401, ISM§1504, ISM§1505, ISM§1546, ISM§1557, ISM§1558, ISM§1559, ISM§1560, ISM§1561
Description	The `MaxAuthTries` parameter specifies the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged. to set MaxAUthTries edit `/etc/ssh/sshd_config` as follows: MaxAuthTries 4
Rationale	Setting the MaxAuthTries parameter to a low number will minimize the risk of successful brute force attacks to the SSH server.

Set SSH MaxSessions limit

Rule ID sshd_set_max_sessions

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

References: CIS§5.2.22

Description

The MaxSessions parameter specifies the maximum number of open sessions permitted from a given connection. To set MaxSessions edit /etc/ssh/sshd_config as follows:

MaxSessions 10

Rationale

To protect a system from denial of service due to a large number of concurrent sessions, use the rate limiting function of MaxSessions to protect availability of sshd logins and prevent overwhelming the daemon.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


var_sshd_max_sessions='10'



if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*MaxSessions\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "MaxSessions $var_sshd_max_sessions" >> "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config"
    printf '%s\n' "MaxSessions $var_sshd_max_sessions" >> "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: XCCDF Value var_sshd_max_sessions # promote to variable
  set_fact:
    var_sshd_max_sessions: !!str 10
  tags:
    - always

- name: Set SSH MaxSessions limit
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxSessions\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxSessions\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*MaxSessions\s+
        line: MaxSessions {{ var_sshd_max_sessions }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sshd_set_max_sessions

Ensure SSH MaxStartups is configured

Rule ID sshd_set_maxstartups

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

References: CIS§5.2.21

Description

The MaxStartups parameter specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. Additional connections will be dropped until authentication succeeds or the LoginGraceTime expires for a connection. To confgure MaxStartups, you should add or correct the following line in the /etc/ssh/sshd_config file:

MaxStartups 10:30:100

CIS recommends a MaxStartups value of '10:30:60', or more restrictive where dictated by site policy.

Rationale

To protect a system from denial of service due to a large number of pending authentication connection attempts, use the rate limiting function of MaxStartups to protect availability of sshd logins and prevent overwhelming the daemon.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


var_sshd_set_maxstartups='10:30:100'



if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*MaxStartups\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "MaxStartups $var_sshd_set_maxstartups" >> "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" > "/etc/ssh/sshd_config"
    printf '%s\n' "MaxStartups $var_sshd_set_maxstartups" >> "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" >> "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_sshd_set_maxstartups # promote to variable
  set_fact:
    var_sshd_set_maxstartups: !!str 10:30:100
  tags:
    - always

- name: Ensure SSH MaxStartups is configured
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxStartups\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MaxStartups\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*MaxStartups\s+
        line: MaxStartups {{ var_sshd_set_maxstartups }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_maxstartups

Use Only Approved Ciphers

Rule ID sshd_use_approved_ciphers

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

Limit the ciphers to those algorithms which are approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. The following line in /etc/ssh/sshd_config demonstrates use of approved ciphers:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

The man page sshd_config(5) contains a list of supported ciphers. The rule is parametrized to use the following ciphers: aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr.

Rationale

Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and system data may be compromised.
Operating systems utilizing encryption are required to use approved mechanisms for authenticating to cryptographic modules.
FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets industry and government requirements. For government systems, this allows Security Levels 1, 2, 3, or 4 for use on Ubuntu 20.04.

Warnings

warning The system needs to be rebooted for these changes to take effect.

warning To achieve FIPS compliance, System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications. FIPS-140 is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing and implementing cryptographic modules that Federal departments and agencies operate or are operated for them under contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf To meet this, the system has to have cryptographic software provided by a vendor that has undergone this certification. This means providing documentation, test results, design information, and independent third party review by an accredited lab. While open source software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to this process.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sshd_approved_ciphers='aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/ssh/sshd_config"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^Ciphers")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$sshd_approved_ciphers"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^Ciphers\\>" "/etc/ssh/sshd_config"; then
    "${sed_command[@]}" "s/^Ciphers\\>.*/$formatted_output/gi" "/etc/ssh/sshd_config"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/ssh/sshd_config" >> "/etc/ssh/sshd_config"
    printf '%s\n' "$formatted_output" >> "/etc/ssh/sshd_config"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value sshd_approved_ciphers # promote to variable
  set_fact:
    sshd_approved_ciphers: !!str aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
  tags:
    - always

- name: Use Only Approved Ciphers
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Ciphers\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*Ciphers\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*Ciphers\s+
        line: Ciphers {{ sshd_approved_ciphers }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.11
    - NIST-800-171-3.13.8
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_use_approved_ciphers

Use Only Approved KEXs

Rule ID	sshd_use_approved_kexs
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.2.14
Description	Limit the KEXs to those key exchange algorithms which are approved. The following line in `/etc/ssh/sshd_config` demonstrates use of approved KEXs: KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256 The man page `sshd_config(5)` contains a list of supported MACs. The rule is parametrized to use the following KEXs: `ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256`.
Rationale	DoD Information Systems are required to use approved cryptographic key exchange algorithms. Key exchange methods that are considered weak should be removed. A key exchange method may be weak because too few bits are used, or the hashing algorithm is considered too weak. Using weak algorithms could expose connections to man-in-the-middle attacks.
Warnings	warning The system needs to be rebooted for these changes to take effect. warning To achieve FIPS compliance, System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications. FIPS-140 is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. This standard shall be used in designing and implementing cryptographic modules that Federal departments and agencies operate or are operated for them under contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf To meet this, the system has to have cryptographic software provided by a vendor that has undergone this certification. This means providing documentation, test results, design information, and independent third party review by an accredited lab. While open source software is capable of meeting this, it does not meet FIPS-140 unless the vendor submits to this process.

Use Only Approved MACs

Rule ID sshd_use_approved_macs

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

Limit the MACs to those hash algorithms which are approved. The following line in /etc/ssh/sshd_config demonstrates use of approved MACs:

MACs hmac-sha2-512,hmac-sha2-256,hmac-sha1

The man page sshd_config(5) contains a list of supported MACs. The rule is parametrized to use the following MACs: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha2-512.

Rationale

DoD Information Systems are required to use approved cryptographic hash functions. The only SSHv2 hash algorithms meeting this requirement is SHA2.

Warnings

warning The system needs to be rebooted for these changes to take effect.

Remediation Shell script: (show)

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then


sshd_approved_macs='hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha2-512'



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/ssh/sshd_config"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^MACs")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$sshd_approved_macs"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^MACs\\>" "/etc/ssh/sshd_config"; then
    "${sed_command[@]}" "s/^MACs\\>.*/$formatted_output/gi" "/etc/ssh/sshd_config"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/ssh/sshd_config" >> "/etc/ssh/sshd_config"
    printf '%s\n' "$formatted_output" >> "/etc/ssh/sshd_config"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value sshd_approved_macs # promote to variable
  set_fact:
    sshd_approved_macs: !!str hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha2-512
  tags:
    - always

- name: Use Only Approved MACs
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MACs\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*MACs\s+
        state: absent
      when: dupes.found is defined and dupes.found > 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*MACs\s+
        line: MACs {{ sshd_approved_macs }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.11
    - NIST-800-171-3.13.8
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_use_approved_macs

Verify Group Who Owns SSH Server config file

Rule ID	file_groupowner_sshd_config
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.2.1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§AC-17(a), NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the group owner of `/etc/ssh/sshd_config`, run the command: $ sudo chgrp root /etc/ssh/sshd_config
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.

Verify Owner on SSH Server config file

Rule ID	file_owner_sshd_config
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.2.1, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§AC-17(a), NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the owner of `/etc/ssh/sshd_config`, run the command: $ sudo chown root /etc/ssh/sshd_config
Rationale	Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.

Verify Permissions on SSH Server config file

Rule ID file_permissions_sshd_config

Result

fail

Time 2023-09-07T09:13:40

Severity medium

Identifiers and References

Description

To properly set the permissions of /etc/ssh/sshd_config, run the command:

$ sudo chmod 0600 /etc/ssh/sshd_config

Rationale

Service configuration files enable or disable features of their respective services that if configured incorrectly can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the correct group to prevent unauthorized changes.

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

chmod 0600 /etc/ssh/sshd_config

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/ssh/sshd_config
  stat:
    path: /etc/ssh/sshd_config
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_sshd_config
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0600 on /etc/ssh/sshd_config
  file:
    path: /etc/ssh/sshd_config
    mode: '0600'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_sshd_config
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

Verify Permissions on SSH Server Private *_key Key Files

Rule ID	file_permissions_sshd_private_key
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: ANSSI§BP28(R36), CIS§5.2.2, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, CUI§3.1.13, CUI§3.13.10, DISA§CCI-000366, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§AC-17(a), NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the permissions of `/etc/ssh/_key`, run the command: $ sudo chmod 0640 /etc/ssh/_key
Rationale	If an unauthorized user obtains the private SSH host key file, the host could be impersonated.

Verify Permissions on SSH Server Public *.pub Key Files

Rule ID	file_permissions_sshd_pub_key
Result	pass
Time	2023-09-07T09:13:40
Severity	medium
Identifiers and References	References: CIS§5.2.3, CIS-CSC§12, CIS-CSC§13, CIS-CSC§14, CIS-CSC§15, CIS-CSC§16, CIS-CSC§18, CIS-CSC§3, CIS-CSC§5, COBIT5§APO01.06, COBIT5§DSS05.04, COBIT5§DSS05.07, COBIT5§DSS06.02, CUI§3.1.13, CUI§3.13.10, DISA§CCI-000366, ISA-62443-2009§4.3.3.7.3, ISA-62443-2013§SR 2.1, ISA-62443-2013§SR 5.2, ISO27001-2013§A.10.1.1, ISO27001-2013§A.11.1.4, ISO27001-2013§A.11.1.5, ISO27001-2013§A.11.2.1, ISO27001-2013§A.13.1.1, ISO27001-2013§A.13.1.3, ISO27001-2013§A.13.2.1, ISO27001-2013§A.13.2.3, ISO27001-2013§A.13.2.4, ISO27001-2013§A.14.1.2, ISO27001-2013§A.14.1.3, ISO27001-2013§A.6.1.2, ISO27001-2013§A.7.1.1, ISO27001-2013§A.7.1.2, ISO27001-2013§A.7.3.1, ISO27001-2013§A.8.2.2, ISO27001-2013§A.8.2.3, ISO27001-2013§A.9.1.1, ISO27001-2013§A.9.1.2, ISO27001-2013§A.9.2.3, ISO27001-2013§A.9.4.1, ISO27001-2013§A.9.4.4, ISO27001-2013§A.9.4.5, NERC-CIP§CIP-003-3 R5.1.1, NERC-CIP§CIP-003-3 R5.3, NERC-CIP§CIP-004-3 R2.3, NERC-CIP§CIP-007-3 R2.1, NERC-CIP§CIP-007-3 R2.2, NERC-CIP§CIP-007-3 R2.3, NERC-CIP§CIP-007-3 R5.1, NERC-CIP§CIP-007-3 R5.1.1, NERC-CIP§CIP-007-3 R5.1.2, NIST§AC-17(a), NIST§CM-6(a), NIST§AC-6(1), NIST-CSF§PR.AC-4, NIST-CSF§PR.DS-5, SRG§SRG-OS-000480-GPOS-00227
Description	To properly set the permissions of `/etc/ssh/.pub`, run the command: $ sudo chmod 0644 /etc/ssh/.pub
Rationale	If a public host key file is modified by an unauthorized user, the SSH service may be compromised.

Benchmark built by Ubuntu Security Guide